ClawHub
Back to skill

Security audit

i18n (Internationalization) guideline skills for nextjs web development

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Next.js i18n guidance skill, but one JSON-LD example teaches an unsafe pattern that can introduce stored cross-site scripting in apps that use CMS or translation-controlled content.

Review before installing or following the examples. The skill is not trying to execute code or access credentials, but update the JSON-LD examples to use an HTML-safe serializer before placing dynamic data in script tags, and treat the English root-locale convention as configurable for your project.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/structured-data.md:20
Finding

Unsafe JSON-LD Serialization Can Introduce Stored Cross-Site Scripting

Content
View full analysis
Remediation
View remediation
/g, '\\u003e') .replace(/&/g, '\\u0026') .replace(/\u2028/g, '\\u2028') .replace(/\u2029/g, '\\u2029') } ``` Render the safely serialized value instead: ```tsx `, HTML tags, ampersands, and Unicode line-separator characters. 5. Deploy a restrictive Content Security Policy as defense in depth, preferably using per-request nonces and avoiding broad `unsafe-inline` allowances. 6. Do not rely solely on CMS trust or JSON validity; serialization must remain safe even if upstream content is compromised. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/sitemap.md (reported line 31)May include surrounding context.

xml
<url>
  <!-- Canonical URL (default locale, no language prefix) -->
  <loc>https://example.com/products</loc>

  <!-- Alternate for every supported locale -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/sitemap.md (reported line 80)May include surrounding context.

md
<priority>1.0</priority>
  </url>

  <!-- Static page -->
  <url>
    <loc>https://example.com/about</loc>
    <xhtml:link rel="alternate" hreflang="en"       href="https://example.com/about"/>

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/structured-data.md (reported line 59)May include surrounding context.

md
<Script
      id="webapplication-schema"
      type="application/ld+json"
      dangerouslySetInnerHTML={{ __html: JSON.stringify(webAppSchema) }}
    />
    {children}
  </>

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/structured-data.md (reported line 120)May include surrounding context.

md
<Script
      id="webapplication-schema"
      type="application/ld+json"
      dangerouslySetInnerHTML={{ __html: JSON.stringify(webAppSchema) }}
    />
    {children}
  </>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The guidance states that the default locale is English and prescribes English-specific URL behavior. This is a natural-language locale policy choice presented as mandatory, but the file does not offer user choice or explain a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The statement 'Always include translated strings and the inLanguage field' imposes a language/localization requirement in natural language guidance, but the document does not indicate that language selection is user-driven or otherwise optional. Under the policy rule, forcing a specific language/locale behavior without explicit user opt-in or documented justification is a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The statement explicitly enforces English as the root URL structure: "English canonical has no /en prefix." This is a natural-language locale policy constraint, and the document does not indicate that this language preference is optional, user-selectable, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The guidance requires maintaining "every other locale file" and discusses locale-specific dictionaries, but it does not force a single language or locale on users. However, because this is the only applicable policy-related area in the file, the language behavior is only loosely documented and not clearly framed as user-selectable or region-scoped.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.