ClawHub
Back to skill

Security audit

Nextjs

Security checks across malware telemetry and agentic risk

Overview

This is a Next.js guidance skill with broad routing language but no hidden execution, credential use, persistence, or destructive behavior.

Install it if you want general Next.js App Router guidance. Be aware it may activate for broad Next.js questions, so use a more specific skill or instruction when you need a narrower workflow such as security review, production deployment, or auth-only implementation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The suggested prompt is so generic that it can trigger this skill for ordinary Next.js requests that may not have intended to invoke a specialized automation skill. This creates a prompt-routing or overreach risk where the agent may apply this skill too broadly, increasing the chance of unintended behavior, surprising tool use, or bypass of more specific safeguards in other workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal