Nextjs

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

The skill is mostly Next.js guidance, but it needs review because it recommends unpinned remote codemods and includes examples that expose session tokens in rendered pages.

Install only if you are comfortable treating it as review-required guidance. Do not run the npx codemod commands verbatim without pinning or verifying the package version and reviewing changes in a clean branch or isolated environment. Do not copy examples that display session or token cookie values in HTML; use cookies server-side for authorization and render only non-sensitive state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:180
• Finding: Unpinned Third-Party Codemods Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58`, `SKILL.md:180-181`, and `SKILL.md:194` **Vulnerability Type**: Unsafe use of mutable third-party package versions **Risk Level**: Medium ### Vulnerable Code ```bash npx @next/codemod@canary upgrade latest npx @next/codemod@canary next-async-request-api ``` The Skill repeats these commands elsewhere, including: ```bash npx @next/codemod@canary next-async-request-api ``` ### Technical Analysis The Skill instructs users to execute the `@next/codemod` package using `npx` and the mutable `canary` distribution tag. It also passes the mutable `latest` release selector to the upgrade codemod. When the requested package is not installed locally, `npx` can download it from the configured package registry and immediately execute its package entry point. The `canary` tag can resolve to different package versions over time, so the code ultimately executed is not fixed to the version reviewed when this Skill was published. Codemods legitimately require repository read and write access to perform migrations. However, this makes unsafe dependency resolution particularly consequential: the downloaded package runs with the invoking developer's OS privileges and can access files, environment variables, credentials available to the process, and the network. The behavior exceeds the minimum safe privilege model because no exact version, integrity verification, isolated environment, or mandatory review step is specified. This is a supply-chain exposure rather than evidence that the current official package is malicious. ### Attack Path 1. An attacker compromises the upstream package, maintainer account, publishing credentials, package registry, or mutable `canary` release channel. 2. The attacker publishes a malicious package version and causes the `canary` tag to resolve to it. 3. A developer follows the Skill and runs the documented `npx` command. 4. `npx` downloads and executes the newly resolved packa ...[truncated 1129 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable `canary` and `latest` selectors with an exact, reviewed package version. 2. Record the exact dependency version and integrity information in a lockfile before execution. 3. Download or install the codemod separately, inspect its provenance, and execute only the reviewed version. 4. Run migration tools in a disposable container, sandbox, or restricted development environment without unnecessary secrets. 5. Create a clean source-control branch and ensure the working tree is committed before running a codemod. 6. Review all resulting changes with `git diff`, then run tests and static analysis before committing. 7. Configure registry allowlists and package-signature or provenance verification where supported. 8. Avoid exposing cloud, deployment, and package-publishing credentials to the codemod process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:108
• Finding: Session Tokens Rendered into Client-Visible HTML<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-45`, `SKILL.md:50-52`, and `SKILL.md:108-111` **Vulnerability Type**: Plaintext disclosure of authentication tokens **Risk Level**: High ### Vulnerable Code ```typescript const cookieStore = await cookies(); const headersList = await headers(); const token = cookieStore.get('session'); const userAgent = headersList.get('user-agent'); return <div><h1>Dashboard</h1><p>Session: {token?.value}</p></div>; ``` A second example exposes a token in the same way: ```typescript const cookieStore = await cookies(); const token = cookieStore.get('token'); return <div>Token: {token?.value}</div>; ``` ### Technical Analysis The examples retrieve authentication-related cookie values and interpolate the raw token into rendered JSX. Although the code executes as a Server Component, values included in its rendered output are sent to the client as response content. Server-side execution therefore does not protect the token once it is placed in the returned markup. This defeats the confidentiality benefits normally provided by an `HttpOnly` session cookie. A token that browser JavaScript could not directly read may nevertheless become observable through the DOM, serialized framework data, response inspection, browser extensions, screenshots, monitoring tools, or HTML capture and logging systems. Reading a session cookie on the server can be necessary for authorization. Returning its raw value to the browser is not necessary for demonstrating asynchronous `cookies()` usage and exceeds the minimum data exposure needed for the Skill's declared Next.js guidance. The separate `fetch()` examples do not attach these tokens to their network requests, so the audit did not confirm direct token exfiltration to the placeholder external API domains. ### Attack Path 1. A developer copies the documented Server Component pattern into an application. 2. An authenticated user requests the affected page. 3. The server reads ...[truncated 1298 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never interpolate session IDs, bearer tokens, API keys, or authentication-cookie values into JSX, HTML, logs, errors, or serialized client data. 2. Use the cookie exclusively on the server to authenticate the request or retrieve a non-sensitive user record. 3. Demonstrate the asynchronous API with a harmless preference cookie, or return a boolean authentication state rather than the secret: ```typescript const cookieStore = await cookies(); const authenticated = Boolean(cookieStore.get('session')); return ( <div> <h1>Dashboard</h1> <p>{authenticated ? 'Authenticated' : 'Not authenticated'}</p> </div> ); ``` 4. Configure session cookies with `HttpOnly`, `Secure`, and an appropriate `SameSite` policy. 5. Use short token lifetimes, rotation, revocation, and replay protections where appropriate. 6. Review response logging, error tracking, APM, and browser telemetry configurations to ensure secrets are redacted. 7. Add automated secret-exposure tests or linting rules that reject rendering values retrieved from authentication cookies. 8. Revoke and rotate any real tokens that may already have been exposed through copied implementations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The documentation recommends executing `npx @next/codemod@canary ...`, which pulls and runs remote package code at invocation time without pinning to an immutable version. In a skill intended to guide developer actions, this creates a supply-chain risk because future package updates or a compromised canary release could execute unexpected code on the user's machine.

External Transmission

Medium

• Category: Data Exfiltration

Content

```typescript
// Next.js 14: cached automatically (dangerous assumption)
export async function GET() {
  const data = await fetch('https://api.example.com/data');
  return Response.json(data);
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```typescript
// Next.js 14: cached automatically (dangerous assumption)
export async function GET() {
  const data = await fetch('https://api.example.com/data');
  return Response.json(data);
}

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export default async function BlogPost({ params }: PageProps) {
  const { slug } = await params;  // Must await in v15+
  const post = await fetch(`https://api.com/posts/${slug}`);
  return <article>{/* ... */}</article>;
}
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This migration checklist instructs users to run a remote codemod package via `npx` using the mutable `@canary` tag. Because `npx` executes fetched code directly, an attacker controlling or compromising that release channel could achieve code execution in the developer environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The second checklist command again uses `npx @next/codemod@canary`, exposing users to execution of unpinned remote code. Repetition in a migration checklist increases the likelihood that users will run it verbatim, making the supply-chain exposure more operationally relevant.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The references section promotes another `npx @next/codemod@canary` command, which normalizes running mutable third-party code directly from documentation. In security terms this is a genuine supply-chain weakness, even if the author's intent is simply to provide convenient upgrade instructions.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The section labeled 'Pitfall 3' states 'App Router requires React 19' and immediately recommends installing latest React. This is an intent/documentation mismatch because the skill otherwise presents itself as accurate migration guidance for Next.js 15/16, but this statement is not generally true for all App Router usage and can mislead users about mandatory upgrades.

Static analysis

No suspicious patterns detected.