ClawHub
Back to skill

Security audit

Nextjs

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly Next.js guidance, but it needs review because it recommends unpinned remote codemods and includes examples that expose session tokens in rendered pages.

Install only if you are comfortable treating it as review-required guidance. Do not run the npx codemod commands verbatim without pinning or verifying the package version and reviewing changes in a clean branch or isolated environment. Do not copy examples that display session or token cookie values in HTML; use cookies server-side for authorization and render only non-sensitive state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:180
Finding

Unpinned Third-Party Codemods Executed Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:108
Finding

Session Tokens Rendered into Client-Visible HTML

Content
View full analysis

Dashboard

Session: {token?.value}

; ``` A second example exposes a token in the same way: ```typescript const cookieStore = await cookies(); const token = cookieStore.get('token'); return
Token: {token?.value}
; ``` ### Technical Analysis The examples retrieve authentication-related cookie values and interpolate the raw token into rendered JSX. Although the code executes as a Server Component, values included in its rendered output are sent to the client as response content. Server-side execution therefore does not protect the token once it is placed in the returned markup. This defeats the confidentiality benefits normally provided by an `HttpOnly` session cookie. A token that browser JavaScript could not directly read may nevertheless become observable through the DOM, serialized framework data, response inspection, browser extensions, screenshots, monitoring tools, or HTML capture and logging systems. Reading a session cookie on the server can be necessary for authorization. Returning its raw value to the browser is not necessary for demonstrating asynchronous `cookies()` usage and exceeds the minimum data exposure needed for the Skill's declared Next.js guidance. The separate `fetch()` examples do not attach these tokens to their network requests, so the audit did not confirm direct token exfiltration to the placeholder external API domains. ### Attack Path 1. A developer copies the documented Server Component pattern into an application. 2. An authenticated user requests the affected page. 3. The server reads ...[truncated 1298 chars]
Remediation
View remediation

Dashboard

{authenticated ? 'Authenticated' : 'Not authenticated'}

); ``` 4. Configure session cookies with `HttpOnly`, `Secure`, and an appropriate `SameSite` policy. 5. Use short token lifetimes, rotation, revocation, and replay protections where appropriate. 6. Review response logging, error tracking, APM, and browser telemetry configurations to ensure secrets are redacted. 7. Add automated secret-exposure tests or linting rules that reject rendering values retrieved from authentication cookies. 8. Revoke and rotate any real tokens that may already have been exposed through copied implementations. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The documentation recommends executing npx @next/codemod@canary ..., which pulls and runs remote package code at invocation time without pinning to an immutable version. In a skill intended to guide developer actions, this creates a supply-chain risk because future package updates or a compromised canary release could execute unexpected code on the user's machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

typescript
// Next.js 14: cached automatically (dangerous assumption)
export async function GET() {
  const data = await fetch('https://api.example.com/data');
  return Response.json(data);
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

typescript
// Next.js 14: cached automatically (dangerous assumption)
export async function GET() {
  const data = await fetch('https://api.example.com/data');
  return Response.json(data);
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

export default async function BlogPost({ params }: PageProps) { const { slug } = await params; // Must await in v15+ const post = await fetch(https://api.com/posts/${slug}); return

{/* ... */}; }

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This migration checklist instructs users to run a remote codemod package via npx using the mutable @canary tag. Because npx executes fetched code directly, an attacker controlling or compromising that release channel could achieve code execution in the developer environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The second checklist command again uses npx @next/codemod@canary, exposing users to execution of unpinned remote code. Repetition in a migration checklist increases the likelihood that users will run it verbatim, making the supply-chain exposure more operationally relevant.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The references section promotes another npx @next/codemod@canary command, which normalizes running mutable third-party code directly from documentation. In security terms this is a genuine supply-chain weakness, even if the author's intent is simply to provide convenient upgrade instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The section labeled 'Pitfall 3' states 'App Router requires React 19' and immediately recommends installing latest React. This is an intent/documentation mismatch because the skill otherwise presents itself as accurate migration guidance for Next.js 15/16, but this statement is not generally true for all App Router usage and can mislead users about mandatory upgrades.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.