ClawHub

Next.js 15 Best Practices

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Next.js best-practices skill with ordinary illustrative code examples and no hidden install, persistence, or data-transfer behavior.

Reasonable to install if you want a Next.js 15 reference skill. Review example npm/npx commands before running them in a real project, and replace placeholder URLs or environment variables with your own values only when appropriate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
}

// fetch with cache control
const data = await fetch("https://api.example.com/data", {
  next: { revalidate: 60 },   // ISR: revalidate every 60s
  // cache: "no-store"         // always fresh
  // cache: "force-cache"      // static, until manual revalidation
Confidence
50% confidence
Finding
https://api.example.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal