T09 · Insecure Skill Coding Practices
Warning
- Location
references/route-handlers.md:81- Finding
Authentication Cookie Token Disclosed in JSON Response
- Content
View full analysis
- Remediation
View remediation
Security audit
Nextjs
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a Next.js documentation skill, but it needs Review because some examples could teach agents to expose session/config data and its install/migration commands run mutable remote packages.
Review before installing. Prefer pinned installer and codemod versions, avoid copying the example that returns cookie tokens or server-only environment values to clients, and add privacy/consent checks before using analytics, tag-manager, maps, or embedded third-party scripts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:35- Finding
Unpinned Third-Party Packages Executed Through npx
- Content
View full analysis
- Remediation
View remediation
npx --no-install next-codemod next-async-request-api . ``` For repository installation, use an immutable reviewed revision: ```bash # Replace the placeholder with a reviewed full commit SHA. npx add https://github.com/wpank/ai/tree//skills/frontend/nextjs ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 65% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
tsx // BAD: Missing id <Script dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} /> // GOOD: Has id <Script id="my-script" dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 65% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
tsx // BAD: Missing id <Script dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} /> // GOOD: Has id <Script id="my-script" dangerouslySetInnerHTML={{ __html: 'console.log("hi")' }} />
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to execute remote package/code via
npx addfrom a GitHub URL without pinning to a specific immutable version, tag, or commit. This creates a supply-chain risk because future upstream changes or compromise of the referenced source could cause different code to run than what was originally reviewed.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx clawhub@latest install nextjspulls and executes the latest version of a remote package at runtime, which is inherently mutable. If the package is updated maliciously or compromised, users following the README may execute attacker-controlled code.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
From your project root:
bash mkdir -p .cursor/skills cp -r ~/.ai-skills/skills/frontend/nextjs .cursor/skills/nextjs
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
From your project root:
bash mkdir -p .claude/skills cp -r ~/.ai-skills/skills/frontend/nextjs .claude/skills/nextjs
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code (global)
bash mkdir -p ~/.claude/skills cp -r ~/.ai-skills/skills/frontend/nextjs ~/.claude/skills/nextjs
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md --- name: nextjs model: standard description: Next.js App Router best practices — Server Components, data fetching, caching, routing, middleware, metadata, error handling, streaming, Server Actions, and performance optimization for Next.js 14-16+. keywords: [next.js, nextjs, app router, server components, rsc, server actions, streaming, suspense, parallel routes, intercepting routes, metadata, middleware, caching, revalidation, image optimization, font optimization] user-invocable: false
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The installation command uses
npx clawhub@latest install nextjs, which executes a remote package at its latest published version rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code on the user's machine at install time.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md const users = await db.user.findMany(); // Or fetch from external API const posts = await fetch('https://api.example.com/posts').then(r => r.json()); return ( <ul>
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The documentation instructs users to run
npx @next/codemod@latest upgrade, which fetches and executes remote package code without pinning to a specific reviewed version. If the upstream package is compromised, malicious, or changed unexpectedly, users could execute attacker-controlled code during the migration step. In a developer skill focused on framework best practices, this is more dangerous because readers are likely to copy-paste the command directly into a trusted shell environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example reads a token from cookies and returns it in a JSON response, which normalizes exposing credential material back to the client. In a documentation skill about Next.js route handlers, readers may copy this pattern into real APIs, causing session tokens or auth secrets to be disclosed to browsers, logs, intermediaries, or attacker-controlled scripts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file recommends integrating Google Analytics, Google Tag Manager, YouTube embeds, Google Maps embeds, and other third-party scripts, all of which can transmit user or system data to external services. The documentation does not include any warning about privacy impact, consent requirements, or the fact that these integrations may collect user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The runtime config example returns values derived from server-side environment variables directly from an API route without warning that only explicitly safe, non-secret values should be exposed. Readers may copy this pattern and accidentally leak internal URLs, feature flags, deployment metadata, or even sensitive configuration if they broaden the response later.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This is a natural-language policy concern because the document uses absolute language to force particular choices regardless of user preference or project context. The rule set allows documented, justified constraints, but these lines present blanket requirements rather than optional recommendations or scoped guidance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file applies to SQP-3, and the embedded example sets the HTML language to English explicitly. Because the file does not indicate that English is optional or justified by a region-specific requirement, it may conflict with language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This example repeats the same locale constraint by setting the document language to English. Repeated guidance can normalize a fixed-language default without clarifying that the locale should be chosen based on user or application context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This is another natural-language policy issue in an example string literal affecting locale handling. The example provides no indication that developers should adapt the value to their users' locale, which can encourage unnecessary English-only defaults.
- Content
Static analysis
No suspicious patterns detected.