ClawHub
Back to skill

Security audit

Next.js全栈指南

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Next.js full-stack guidance skill that may generate project files and suggest development commands, with no evidence of hidden data access or persistence.

Install this if you want a Chinese-language Next.js full-stack guide for generating or reviewing project structure. Before allowing commands, confirm they are normal project setup/build/test/deploy commands for the current workspace, and review generated auth, middleware, and environment-variable code before using it in production.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
Overly broad trigger keywords like general web-development terms can cause the skill to activate in many unrelated coding contexts. In an agent with read/exec/write capabilities, ambiguous invocation increases the chance of unintended file generation, command execution, or workflow takeover beyond the user's actual request.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The broad 'use when' language lacks concrete activation boundaries and invites the skill to engage for generic code generation, debugging, and deployment requests. Because the skill exposes exec/write-oriented workflows, this ambiguity can expand the skill's operational scope and increase the risk of unintended actions or unsafe automation.

Static analysis

No suspicious patterns detected.