nextjs-code-review
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured, educational content and analysis instructions that adhere to established Next.js development patterns. No malicious behavior or unsafe commands were detected in the instructions or reference files.
- [PROMPT_INJECTION]: The skill processes untrusted application source code as its primary function, which presents an inherent surface for indirect prompt injection.
- Ingestion points: The skill reads file content discovered via
GlobandGreptools, specifically targeting Next.js route segments likepage.tsxandmiddleware.ts(documented inSKILL.md). - Boundary markers: There are no explicit instructions requiring the agent to use delimiters or ignore instructions embedded within the code comments or strings of the analyzed files (documented in
SKILL.md). - Capability inventory: The skill is configured with high-privilege tools including
BashandEdit, which could be targeted by an attacker-controlled code file (documented inSKILL.md). - Sanitization: No sanitization or safety-filtering is performed on the ingested code before it is passed to the language model for architectural review.
Audit Metadata