next-forge
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Remote Scaffolding Tool]: The skill documentation includes the command
npx next-forge@latest init. This command downloads and executes code from a remote registry to scaffold the project structure. - [CLI Tool Execution]: The skill incorporates common development commands such as
pnpm migrate,prisma studio, andstripe listen. These tools interact with the local development environment and external services to manage databases and webhooks. - [Indirect Prompt Injection Surface]: The skill monitors project files to provide assistance.
- Ingestion points: Project configuration and source code in apps/ and packages/ folders.
- Boundary markers: None explicitly specified for incoming project data.
- Capability inventory: Execution of project commands like pnpm, prisma, stripe, and npx.
- Sanitization: No explicit sanitization or filtering of project-sourced data is described.
Audit Metadata