nextjs-expert
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a legitimate technical reference for Next.js development, containing standard architecture patterns and code examples for App Router, Server Components, and Server Actions.
- [EXTERNAL_DOWNLOADS]: References to external tools like Vercel CLI, PM2, and official monitoring packages (e.g., @vercel/analytics) are appropriate for the skill's context and point to well-known service providers.
- [COMMAND_EXECUTION]: The skill provides templates for server-side operations, including file system access and database interactions using Prisma. These are standard features for the described full-stack developer role.
- [DATA_EXFILTRATION]: A surface for indirect prompt injection exists in the 'Server Actions' documentation. Ingestion points: User-provided form data in Server Actions (references/server-actions.md). Boundary markers: Absent in the provided code templates. Capability inventory: Includes file system writes (writeFile) and database mutations (Prisma). Sanitization: The uploadAvatar example lacks input validation/sanitization for the file.name parameter, which could be exploited for path traversal if implemented without additional security checks. This is documented as a risk factor rather than a malicious finding.
Audit Metadata