Ainative Nextjs Sdk

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:41 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for building an AINative chat app, but its examples expose a server-funded chat API publicly without showing basic abuse, validation, or privacy controls.

Review before installing or using these examples in production. Pin the SDK version, verify the package source and publisher, protect or rate-limit /api/chat, validate request bodies and token usage, add quotas and monitoring, and clearly disclose that chat content is sent to AINative or its upstream model provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party SDK Receives API Credentials and User Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-34 **Vulnerability Type**: Supply-chain risk and excessive trust in a mutable dependency **Risk Level**: Medium ### Evidence ```bash npm install @ainative/next-sdk ``` ```typescript // app/api/chat/route.ts import { createServerClient } from '@ainative/next-sdk/server'; export async function POST(request: Request) { const { messages } = await request.json(); const client = createServerClient({ apiKey: process.env.AINATIVE_API_KEY!, }); // Non-streaming const result = await client.chat.completions.create({ model: 'claude-3-5-sonnet-20241022', messages, max_tokens: 1024, }); return Response.json(result); } ``` ### Technical Analysis The installation command does not pin an exact package version, even though the Skill metadata identifies version `1.0.1`. Consequently, a user following the instructions may install a later, unreviewed release. The imported package runs in the server environment and is explicitly entrusted with `AINATIVE_API_KEY` and client-supplied chat messages. The audited artifact does not contain the package implementation, a dependency lockfile, an integrity hash, an authoritative repository URL, or documentation identifying the network destination and data-handling policy. Therefore, the package's treatment of credentials and message content cannot be verified from this project. Sending an API credential and chat messages to a hosted AI provider is consistent with the declared functionality. The security issue is the combination of sensitive access with a mutable and unaudited dependency, which unnecessarily broadens the supply-chain trust boundary. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or a future package release. 2. A developer follows the unpinned `npm install @ainative/next-sdk` instruction. 3. npm resolves and installs the compromised release rather than the documented version. ...[truncated 702 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the reviewed package version explicitly: ```bash npm install --save-exact @ainative/next-sdk@1.0.1 ``` 2. Commit and enforce a package-manager lockfile in CI and production. 3. Verify npm provenance, package signatures where available, and registry integrity metadata. 4. Document the authoritative source repository, publisher identity, network endpoint, privacy policy, and categories of data sent externally. 5. Audit package source and lifecycle scripts before deployment and after every upgrade. 6. Run the application with minimal environment variables, filesystem permissions, and outbound network access. 7. Restrict outbound traffic to documented provider endpoints where deployment infrastructure supports egress filtering. 8. Rotate the API key immediately if package compromise or unexpected outbound traffic is suspected. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Unauthenticated Public Chat Route Allows Abuse of Server-Side API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-34 and 68-78 **Vulnerability Type**: Missing authentication, input validation, and abuse controls **Risk Level**: High ### Evidence ```typescript // app/api/chat/route.ts import { createServerClient } from '@ainative/next-sdk/server'; export async function POST(request: Request) { const { messages } = await request.json(); const client = createServerClient({ apiKey: process.env.AINATIVE_API_KEY!, }); // Non-streaming const result = await client.chat.completions.create({ model: 'claude-3-5-sonnet-20241022', messages, max_tokens: 1024, }); return Response.json(result); } ``` The middleware example explicitly designates the chat endpoint as public: ```typescript // middleware.ts (repo root or src/) import { createMiddleware } from '@ainative/next-sdk/middleware'; export const middleware = createMiddleware({ apiKey: process.env.AINATIVE_API_KEY!, protectedPaths: ['/dashboard', '/api/protected'], loginPath: '/login', publicPaths: ['/', '/about', '/api/chat'], }); export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'], }; ``` The Pages Router example similarly accepts unvalidated request content: ```typescript export default async function handler(req: NextApiRequest, res: NextApiResponse) { const client = createServerClient({ apiKey: process.env.AINATIVE_API_KEY! }); const result = await client.chat.completions.create({ model: 'claude-3-5-sonnet-20241022', messages: req.body.messages, }); res.json(result); } ``` ### Technical Analysis The examples accept arbitrary client-controlled `messages` values and forward them to an external AI service using the server operator's private API credential. No authentication, authorization, request schema validation, body-size limit, per-user quota, rate limit, or concurrency limit is shown. The middleware configuration explicitly exempts `/api/chat` from auth ...[truncated 1858 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Protect `/api/chat` with authentication and authorization unless anonymous access is an explicit product requirement. 2. Remove `/api/chat` from `publicPaths` when authenticated access is intended. 3. For intentional anonymous access, apply IP-, session-, and device-aware rate limits, strict quotas, concurrency controls, and bot mitigation. 4. Validate the request with a strict schema: - Require an array of permitted message objects. - Allow only expected roles and content types. - Limit message count, individual message length, and total serialized body size. - Reject unknown fields and malformed data. 5. Bound both input and output token usage and enforce a server-side model allowlist. 6. Configure framework/server body-size limits before parsing JSON. 7. Add request timeouts, cancellation handling, upstream error handling, and circuit breakers. 8. Monitor request volume, token consumption, error rates, and cost anomalies; alert on suspected abuse. 9. Avoid logging credentials or full message content, and redact sensitive values from telemetry. 10. Inform users that message content is transmitted to a third-party AI provider and document applicable retention and privacy controls. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

## Environment Variables

```bash
# .env.local
AINATIVE_API_KEY=ak_your_key
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file documents server routes and client code that collect `messages` from users and transmit them via `client.chat.completions.create(...)` to an external AI service, but it does not warn users that chat content will leave their application environment. For markdown files, SQP-2 applies when the description omits warnings about behaviors affecting user data or privacy.

Static analysis

No suspicious patterns detected.