ClawHub
Back to skill

Security audit

Next Best Practices

Security checks for vulnerabilities and agentic risk

Overview

This is a Next.js guidance skill with no executable payload, but several examples could lead an agent to generate insecure application code if copied as best practices.

Install only if you are prepared to treat the examples as rough Next.js notes, not secure templates. Before letting an agent apply this skill, require auth checks, runtime validation, field allowlists, secret redaction, consent/privacy review for analytics, and pinned reviewed versions for npx tools.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Warning
Location
route-handlers.md:99
Finding

Authentication Cookie Disclosed in JSON Response Example

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
data-patterns.md:62
Finding

Server Action Examples Perform Mutations Without Authentication or Authorization

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
data-patterns.md:113
Finding

Route Handler Passes Unvalidated Request Body Directly to ORM

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
async-patterns.md:86
Finding

Mutable Codemod Package Is Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation
npx --no-install @next/codemod next-async-request-api . ``` - Document the reviewed version explicitly and update it through a controlled dependency-review process. ]]>

T08 · Insecure Dependencies

Warning
Location
self-hosting.md:314
Finding

OpenNext and SST Tooling Is Executed Without Exact Version Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts.md (reported line 25)May include surrounding context.

tsx
// Bad: Missing id
<Script dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />

// Good: Has id
<Script id="my-script" dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts.md (reported line 28)May include surrounding context.

tsx
// Bad: Missing id
<Script dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />

// Good: Has id
<Script id="my-script" dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run npx @next/codemod@latest ..., which fetches and executes remote package code without pinning a specific version. If the upstream package is compromised or a malicious release is published, users following this guidance could execute attacker-controlled code on their machine or in CI.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data-patterns.md (reported line 36)May include surrounding context.

md
const users = await db.user.findMany();

  // Or fetch from external API
  const posts = await fetch('https://api.example.com/posts').then(r => r.json());

  return (
    <ul>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file instructs users to call a local MCP endpoint and highlights tools such as get_project_metadata and get_logs, which return the project path, dev server URL, and log file location. The description does not warn that these responses may reveal sensitive local system or project information during debugging.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · debug-tricks.md (reported line 21)May include surrounding context.

The endpoint uses JSON-RPC 2.0 over HTTP POST:

bash
curl -X POST http://localhost:<port>/_next/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The documentation instructs users to run npx @next/codemod@latest upgrade, which fetches and executes the latest published package version at runtime rather than a reviewed, pinned version. If the package or one of its resolution paths were compromised, users following this guidance could execute unintended code on their local machine or CI environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example reads a token from cookies and includes it in a JSON response, which teaches a pattern that exposes sensitive authentication material back to the client. In documentation for Next.js route handlers, readers may copy this directly into production code, increasing the chance of token leakage through browser-visible responses, logs, caches, or client-side script access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Echoing a cookie-derived token back to the client defeats the usual purpose of keeping such credentials confined to secure cookie storage, and can make the token accessible in application responses and downstream telemetry. As a best-practices skill, this is more dangerous because it presents the behavior as a normal request-helper pattern rather than explicitly warning against exposing secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file instructs users to add Google Analytics and Google Tag Manager integrations, which send visitor and system interaction data to third parties. The section provides implementation guidance but does not mention any privacy, consent, or data-sharing implications, which is a missing warning for behavior that can affect user data and privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example recommends exposing runtime configuration through a public API endpoint and returns environment-derived values without any warning, allowlist guidance, or authentication. This pattern can easily lead developers to leak sensitive operational details or mistakenly expose secrets if they copy the example and include unsafe variables.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown includes a deletion mutation example that removes a post directly with db.post.delete, but the surrounding documentation does not mention confirmation, reversibility, or user impact. For markdown files, this qualifies as an omitted warning about behavior that could affect user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The example sets <html lang="en">, which forces an English locale in the provided pattern. Because the document does not mention this as an example-only placeholder, offer alternatives, or justify an English-only constraint, it can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This sample again uses <html lang="en"> as a fixed locale. Repeating the pattern without caveat can encourage implementers to ship English-only markup even when their application serves other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The third layout example uses lang="en" with no surrounding guidance about localization. Across multiple examples, this presents an implicit English-only default rather than offering a user or app-specific locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.