nextjs-app-router

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 1.0.2

Overview

This is a coherent Next.js scaffolding skill, but it needs review because its auth templates include an unsafe post-login redirect and its setup can run a mutable third-party CLI.

Install only if you are comfortable reviewing generated auth and setup code. Before using it for a real app, validate returnTo so login can only redirect to safe same-origin paths, pin any CLI package executed during scaffolding, and run installs/migrations in a development environment without production secrets or databases.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/templates/auth-slice.md:27

Finding

Unvalidated Post-Authentication Redirect

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Note

• Location: SKILL.md:72

Finding

Execution of a Mutable Third-Party CLI Package

Content

View full analysis

version` (e.g. `npm view next version`; `npm view next-auth dist-tags` — plain `npm view next-auth version` returns the latest *stable*, which may still be v4; never scaffold v4). Never write a version you did not just resolve this session — no versions from memory, no `latest`/`^latest`, no invented numbers. 7. **API-drift guard.** The version you resolved in this step decides the API shape — training-data memory is the least trustworthy source in this workflow. ... - The shadcn CLI is `npx shadcn@latest` (`init` / `add`); the old `shadcn-ui` package name is dead. ``` The corresponding component instructions also state: ```markdown add more on demand via `pnpm dlx shadcn@latest add ` ``` ### Technical Analysis `npx` and `pnpm dlx` download and execute npm packages with the invoking user's permissions. The `latest` distribution tag is mutable and can point to different code after the Skill has been reviewed. This creates a remote payload execution channel: the effective executable is selected at invocation time rather than being fixed in the audited artifact. A compromise of the package publisher, npm account, registry, DNS/TLS trust chain, or a malicious upstream release could cause arbitrary code to execute during scaffolding. The behavior is related to the Skill's legitimate dependency-installation function, but using a mutable tag exceeds the minimum necessary privilege. A specific reviewed package version can provide the same functionality with lower supply-chain risk. ### Attack Path 1. The `shadcn` package publisher account or release process is compromised, or a malicious version is published an ...[truncated 1038 chars]

Remediation

View remediation

add ``` 4. Preserve the resolved package and integrity metadata in the project lockfile where feasible. 5. Prefer installing the pinned CLI as a development dependency and invoking the local binary: ```bash pnpm add --save-dev --save-exact shadcn@ pnpm exec shadcn add ``` 6. Review generated files before retaining them and run package installation in a restricted environment without production secrets or broad filesystem access. 7. Replace every `@latest` instruction in both `SKILL.md` and `references/templates/components-json.md`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

components.json              # shadcn config; rsc: true
  .eslintrc.json (or eslint.config.mjs)
  .prettierrc
  .env.example                 # NEVER .env — only .env.example committed
  middleware.ts                # NextAuth-driven route gate; re-exports `auth`
  docker-compose.yml           # optional: only if user picked "local Docker"
  prisma/

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to auto-trigger on broad phrases like 'new Next app', 'use my Next.js conventions', or 'add a feature end-to-end', including when the user does not name the skill. This can cause overbroad activation and unintended file generation or command execution in ordinary conversations, reducing user intent verification and increasing the chance of risky actions being taken on the wrong project or request.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template sets <html lang="en">, which enforces an English locale at the application root. Under the policy, locale-specific behavior should be optional or clearly justified; this file provides neither user opt-in nor documentation that the skill is intentionally English-only.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The login page reads a user-controlled returnTo query parameter and passes it directly to router.replace(returnTo) after successful authentication, with no validation that the destination is same-origin and within an allowed path set. This creates an open-redirect style post-login flow that can be abused for phishing, redirect chaining, or steering authenticated users to attacker-controlled destinations if absolute URLs or crafted paths are accepted by the router.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates/route-handler.md (reported line 125)May include surrounding context.

md

- **No `requireSession()` call** in any handler outside `/api/auth/*` and explicitly-public ones (and the public ones must comment why).
- **Trusting `userId` from the request body.** Always read it from the session: `session.user.id`.
- **Returning the full record on POST/PATCH without checking ownership first** on updates — the `where: { id, userId }` predicate is the gate.
- **`prisma.$queryRaw` with string concatenation.** Use parameterized template literals (`prisma.$queryRaw\`... ${value} ...\``) or stick to the typed query builder.
- **Catching and re-throwing without logging.** `withApiErrors` logs unexpected errors; if you write your own try/catch, log unexpected ones at least once.
- **Returning 500 with the raw error message.** Leaks stack traces. `withApiErrors` returns a generic message; if you write your own, do the same.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown template instructs implementers to parse request JSON in matching API route handlers and the form component performs create/update mutations, but the template does not mention that submitted data will be transmitted to server endpoints and saved. For markdown files, SQP-2 applies when behavior affecting user data or privacy is described without warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description. The text states that the login form uses NextAuth's signIn directly, which implies network transmission of email/password, but it does not include any warning about credential handling or privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.