OpenGemini Next.js Bestpractice Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.1

Overview

This SaaS scaffolding skill is coherent, but needs review because its scripts can overwrite project guidance/docs and send the project brief to Gemini CLI without explicit safeguards.

Install only if you are comfortable with an opinionated Japanese/English SaaS scaffold that uses Gemini CLI. Run it in a new or version-controlled project, review the project brief for sensitive information before generation, and avoid running the scripts against an existing project unless you have backups and expect GEMINI.md, docs, and project-level skills to be replaced.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_project_docs.sh:14

Finding

Unconditional Overwrite of Existing Project Files

Content

View full analysis

Vulnerability Details

File Location: scripts/bootstrap_tree.sh:18-662, scripts/generate_gemini_md.sh:4-37, and scripts/generate_project_docs.sh:14-26
Vulnerability Type: Uncontrolled file overwrite and data loss
Risk Level: Medium

Vulnerable Code

scripts/bootstrap_tree.sh repeatedly overwrites generated Skill files:

bash

cat > "$root/skills/nextjs/SKILL.md" <<'EOF'
---
name: nextjs
description: Use this skill for Next.js App Router work including pages, layouts, route handlers, server actions, metadata, loading/error states, and server/client component boundaries.
---

The same unconditional redirection pattern is used for every generated skills/*/SKILL.md file through line 662.

scripts/generate_gemini_md.sh overwrites the caller-selected output file:

bash

out="${1:-GEMINI.md}"
cat > "$out" <<'EOF'
# Source of truth
1. docs/requirements.md
2. docs/scope.md
3. docs/architecture.md
4. docs/conventions.md
5. docs/decisions/*.md
6. docs/notes/brainstorming.md is reference only

# Stack policy
- Frontend: Next.js App Router
- UI: Tailwind + shadcn/ui
- DB: Neon PostgreSQL
- ORM: Prisma
- Auth: Clerk
- Email: Resend
- Payments: Stripe
- Storage: Cloudflare R2
- Analytics: PostHog
- Error Monitoring: Sentry
- Deploy: Vercel
- Backend: FastAPI only for Python-required workloads

# Backend boundary
- Default backend logic lives in Next.js route handlers or server actions
- FastAPI is only for AI, batch, heavy processing, or Python-specific integrations

# Never do
- Do not duplicate Clerk auth state into Prisma as a full auth system
- Do not treat Stripe success redirect as source of truth; use webhook state
- Do not store uploaded files in PostgreSQL
- Do not add FastAPI endpoints for simple CRUD unless explicitly required
EOF

scripts/generate_project_docs.sh overwrites GEMINI.md and six existing documen ...[truncated 5198 chars]

Remediation

View remediation

Remediation Suggestions

1. Refuse to replace existing files by default:

   bash

   if [[ -e "$out" ]]; then
     printf 'Refusing to overwrite existing file: %s\n' "$out" >&2
     exit 1
   fi
   

2. Add an explicit --force option for intentional replacement. Clearly document that it is destructive.

3. Generate content into a securely created temporary file in the destination directory, validate successful generation, and atomically rename it:

   bash

   destination="$root/docs/requirements.md"
   tmp="$(mktemp "$root/docs/.requirements.md.XXXXXX")"
   trap 'rm -f "$tmp"' EXIT
   
   gemini -p "$prompt" > "$tmp"
   [[ -s "$tmp" ]] || {
     echo "Generated document is empty" >&2
     exit 1
   }
   
   mv -- "$tmp" "$destination"
   trap - EXIT
   

4. Check every external command's output before replacing trusted files. This prevents an authentication failure, quota error, or empty response from destroying the previous document.

5. Reject symbolic-link destinations unless following them is explicitly intended:

   bash

   if [[ -L "$destination" ]]; then
     echo "Refusing to overwrite symbolic link: $destination" >&2
     exit 1
   fi
   

6. Canonicalize and validate the project root before writing. Ensure all generated destinations remain beneath that root.

7. Offer --backup, --dry-run, and interactive confirmation modes for existing projects.

8. Prefer scaffold-only semantics: create absent files and report conflicts so the user can merge generated content manually.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's core purpose and rules are written in Japanese, which implicitly constrains the interaction language without offering the user a language choice or explaining a justified locale-specific scope. This can violate language/locale policy when the skill is otherwise presented as a general-purpose builder rather than a Japan-only or Japanese-only tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple template instructions are written as imperative Japanese placeholders, effectively requiring skill authors to write sections in Japanese. This imposes a language choice without user opt-in or documented regional justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 22)May include surrounding context.

sh

touch "$root"/docs/notes/brainstorming.md

cat > "$root/skills/nextjs/SKILL.md" <<'EOF'
---
name: nextjs
description: Use this skill for Next.js App Router work including pages, layouts, route handlers, server actions, metadata, loading/error states, and server/client component boundaries.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated SKILL.md content states the purpose in Japanese and, more importantly, the file consistently instructs behavior in Japanese across multiple generated skills, effectively imposing a language/locale choice. The policy requires avoiding forced language constraints unless the user is given a choice or the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 88)May include surrounding context.

sh

- 必要なら docs 更新
EOF

cat > "$root/skills/clerk/SKILL.md" <<'EOF'
---
name: clerk
description: Use this skill when implementing authentication, user sessions, protected routes, Clerk middleware, webhook-based user sync, or account/profile flows with Clerk.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 145)May include surrounding context.

sh

- 必要な docs 更新
EOF

cat > "$root/skills/prisma/SKILL.md" <<'EOF'
---
name: prisma
description: Use this skill for Prisma schema changes, migrations, database access patterns, seed scripts, and query/model design with PostgreSQL.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 205)May include surrounding context.

sh

- テスト/確認項目
EOF

cat > "$root/skills/shadcn/SKILL.md" <<'EOF'
---
name: shadcn
description: Use this skill when building or modifying UI with Tailwind CSS and shadcn/ui components, including forms, dialogs, tables, cards, and design consistency work.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 260)May include surrounding context.

sh

- UI確認項目
EOF

cat > "$root/skills/stripe/SKILL.md" <<'EOF'
---
name: stripe
description: Use this skill for Stripe checkout, billing portal, subscriptions, webhook handling, payment state synchronization, and product/price integration.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 316)May include surrounding context.

sh

- テスト観点
EOF

cat > "$root/skills/resend/SKILL.md" <<'EOF'
---
name: resend
description: Use this skill when sending transactional email, onboarding email, passwordless or verification-related messaging, or templated app notifications via Resend.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 365)May include surrounding context.

sh

- エラー処理方針
EOF

cat > "$root/skills/posthog/SKILL.md" <<'EOF'
---
name: posthog
description: Use this skill when implementing product analytics, feature flags, event naming, funnel tracking, or server/client analytics integration with PostHog.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 414)May include surrounding context.

sh

- 計測意図
EOF

cat > "$root/skills/sentry/SKILL.md" <<'EOF'
---
name: sentry
description: Use this skill when adding error monitoring, exception capture, tracing, performance monitoring, or structured production diagnostics with Sentry.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 462)May include surrounding context.

sh

- 文脈情報
EOF

cat > "$root/skills/r2/SKILL.md" <<'EOF'
---
name: r2
description: Use this skill for file upload flows, signed URL generation, object key design, metadata handling, and Cloudflare R2-backed storage patterns.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 511)May include surrounding context.

sh

- metadata モデル
EOF

cat > "$root/skills/fastapi/SKILL.md" <<'EOF'
---
name: fastapi
description: Use this skill only for Python-required backend workloads such as AI pipelines, batch jobs, heavy processing, or Python-native integrations exposed through FastAPI.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 562)May include surrounding context.

sh

- Next.js との境界
EOF

cat > "$root/skills/api-security/SKILL.md" <<'EOF'
---
name: api-security
description: Use this skill when building any route handler, webhook, external API integration, internal API boundary, authorization rule, or security-sensitive request flow.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/bootstrap_tree.sh (reported line 613)May include surrounding context.

sh

- 保護方式
EOF

cat > "$root/skills/vercel/SKILL.md" <<'EOF'
---
name: vercel
description: Use this skill when configuring deployment, environment variables, preview environments, production settings, domain setup, and Vercel-specific deployment behavior.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends the user-supplied project brief to an external gemini CLI six times, which can disclose sensitive business, product, or customer information to a third-party AI service without any warning, consent, or data-minimization controls. In an agent skill context, users may reasonably expect local scaffolding behavior, so silent outbound transmission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This shell script creates many directories and files under the target root, but the script itself provides no comment, prompt, or usage text warning the user that it will modify the filesystem. For a code file, these write operations are visible only through the commands, not through any explicit user disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script redirects a heredoc into "$out", which will create or overwrite the specified file. There is no confirmation prompt, cautionary comment, or user-facing warning beyond a success message after the write completes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.