react-server-components-framework
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends the execution of
npx -y next-devtools-mcp@latestwithin theSKILL.mdfile. This command downloads and executes code from a third-party package on the npm registry that is not associated with a verified or trusted organization. - [DYNAMIC_CONTEXT_INJECTION]: The file
scripts/create-server-component.mdutilizes the!commandsyntax to execute shell commands at skill load time or during file processing. These commands (grep,find,date) are used to automatically detect the Next.js version, project structure, and database configuration. - [COMMAND_EXECUTION]: The skill contains multiple instances of shell command usage for project introspection and template scaffolding, which are executed in the context of the user's environment.
Audit Metadata