nextjs-to-tauri

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 11:13 AM UTC
• Version: 1.1.6

Overview

This skill is a transparent template for packaging a Next.js app as a Tauri desktop app, with expected updater and CI release features that should be configured deliberately.

Before installing, confirm that you want the generated app to use signed auto-updates, contact GitHub release endpoints, silently bootstrap WebView2 on Windows, and use a broad external-link opener permission. Keep the Tauri signing private key out of git, store it only as a GitHub secret, and remove the updater blocks if the app should not download update payloads in the background.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

External Script Fetching

High

• Category: Supply Chain

Content

1. **Verify latest versions first** (they drift — never trust the numbers in templates):
   - npm: `npm view @tauri-apps/cli version` (+ `plugin-opener`, `plugin-updater`)
   - crates: `curl -sA x https://crates.io/api/v1/crates/tauri | node -p "JSON.parse(require('fs').readFileSync(0)).crate.max_stable_version"` (repeat for each `tauri-plugin-*`)
   - actions: `gh api repos/actions/checkout/releases/latest --jq .tag_name` (+ `actions/setup-node`, `Swatinem/rust-cache`, `actions/upload-artifact`; `tauri-apps/tauri-action@v1` is the moving major tag — check its README, not the release list)

2. **Gate static export on Tauri** in `next.config.*`, driven by an EXPLICIT build flag rather than Tauri's auto-injected `TAURI_ENV_PLATFORM` (gotcha #1). Merge into your existing config, keeping the `next-intl` plugin wrapper:

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# The source must be SQUARE (the CLI says "squared PNG or SVG") and 1024x1024 — the
   # generated .icns carries a 1024 layer, so a 512 source is upscaled 2x for macOS.
   yarn tauri icon public/logo.png
   rm -r src-tauri/icons/{android,ios}   # desktop-only; they are directories, hence -r
   ```
   Then **fix `.gitignore`** — see gotcha #3.

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

- name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libgtk-3-dev wget file

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Self-Modification

High

• Category: Rogue Agent

Content

args: ${{ matrix.args }}

      # Portable "green" exe (Windows only): the raw self-contained binary tauri
      # builds anyway. No installer; needs the WebView2 runtime; does NOT self-update.
      # Version comes from the action's appVersion output — the version tauri actually
      # built with (tauri.conf.json, written by `yarn update-version`). Re-reading
      # package.json here would name the file and pick the upload tag from a different

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

args: ${{ matrix.args }}

      # Portable "green" exe (Windows only): the raw self-contained binary tauri
      # builds anyway. No installer; needs the WebView2 runtime; does NOT self-update.
      # Version comes from the action's appVersion output — the version tauri actually
      # built with (tauri.conf.json, written by `yarn update-version`). Re-reading
      # package.json here would name the file and pick the upload tag from a different

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libgtk-3-dev wget file

      - name: Setup Node

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libgtk-3-dev wget file

      - name: Setup Node

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown instructs implementers to call `update.download()` automatically before any user confirmation, but the surrounding documentation does not warn users that the skill behavior downloads update payloads in the background. For markdown files, SQP-2 applies when the description omits warnings about behaviors that may affect user data, privacy, or system integrity; automatic update downloads can affect bandwidth, storage, and system state.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The document instructs implementers to derive a preferred language from `navigator.language` on first run and immediately redirect the user via `router.replace` if it differs from the current locale. This is a natural-language locale policy concern because it enforces a language choice automatically rather than offering the user an explicit opt-in or choice.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This markdown file instructs users to configure `webviewInstallMode: downloadBootstrapper/silent`, which causes an external component to be downloaded and installed automatically. Because this is a markdown skill/template file, it should warn that the app may perform a network download and silent install affecting the user's system.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The template enables the updater plugin with a GitHub releases endpoint, which implies network access and software update behavior. The surrounding markdown explains how to keep or remove the updater block, but it does not warn about privacy/system-integrity implications of remote update checks and update delivery.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The manifest description states the skill 'Triggers on 打包成桌面应用 / 生成 exe', which imposes Chinese-language trigger phrases as the activation wording. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The sample configuration sets `"url": "/en/"`, which forces an English locale path by default. Since the file does not present this as an opt-in language choice or a clearly justified region-specific constraint, it may conflict with language/locale policy expectations.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.