Security audit
Security checks for vulnerabilities and agentic risk
This is a local Next.js audit skill with a read-only scanner; I found no hidden network access, persistence, or destructive behavior.
Install only if you are comfortable letting the agent read the Next.js project source you ask it to audit. The reviewed scanner is local and read-only, but its reports are heuristic leads that should be verified before applying code changes.
Referenced artifact was not completely inspected
r why metadata/SEO tags aren't showing. Ships a zero-dependency static scanner (scripts/audit.mjs) plus a manual review methodology for things static analysis c
Referenced artifact was not completely inspected
r why metadata/SEO tags aren't showing. Ships a zero-dependency static scanner (scripts/audit.mjs) plus a manual review methodology for things static analysis c
Referenced artifact was not completely inspected
r why metadata/SEO tags aren't showing. Ships a zero-dependency static scanner (scripts/audit.mjs) plus a manual review methodology for things static analysis c
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## Use it as a Claude skill
Place the folder in your skills directory (e.g. `~/.claude/skills/`) or upload it
to your skills hub, then ask:
> "Audit this Next.js app for performance and RSC problems."
The example trigger "Audit this Next.js app for performance and RSC problems." is natural everyday phrasing for a coding assistant request and the README provides no explicit trigger boundaries, exclusions, or narrower activation conditions. In a markdown skill description, this can make it unclear when the skill should activate versus when a general assistant response would be more appropriate.
Without declared permissions the skill's intent is opaque and cannot be validated.
The description lists many trigger-style phrases such as 'review/audit a Next.js app', 'find performance problems', and 'debug why a page isn't streaming' without defining boundaries or exclusions. While somewhat domain-specific, the activation guidance is still broad enough that ordinary Next.js help requests could invoke the skill unintentionally.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// and no metadata export. The scanner should flag `request-waterfall` (INFO)
// and `page-missing-metadata` (WARN).
export default async function FeedPage() {
const user = await fetch("https://api.example.com/user").then((r) => r.json());
const posts = await fetch("https://api.example.com/posts").then((r) => r.json());
return (
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// and no metadata export. The scanner should flag `request-waterfall` (INFO)
// and `page-missing-metadata` (WARN).
export default async function FeedPage() {
const user = await fetch("https://api.example.com/user").then((r) => r.json());
const posts = await fetch("https://api.example.com/posts").then((r) => r.json());
return (
No suspicious patterns detected.