{"data":{"skill":{"slug":"ariegoldkin-react-server-components-framework","name":"react-server-components-framework","icon":"📦","repo":"https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/react-server-components-framework","status":"approved","author":"AI Agent Hub","authorVersion":"1.0.0","skillstoreRevision":2},"audit":{"id":"28ae6938-8ad7-4fdf-8b48-c785aba1d4ef","skill_id":"7147efec-d53b-4fe5-9462-6d5831c73741","version":9,"content_hash":"v3:89edfdc710d0846129dcee6a929477b04f08052c:ab5326747954a20452345872dc6ad27c82203cb27bad51e6c9c2a3209738714c:e0d302990ff398d94abad11bc0d30d3ade8a064f50aca3ba7ff5f4b6f1caff49:736b696c6c732f61726965676f6c646b696e2f72656163742d7365727665722d636f6d706f6e656e74732d6672616d65776f726b:52c64c33b7182802e7ee1b8ae0bf55c9","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 127 static alerts are false positives caused by documentation formatting, standard React patterns, placeholder fetch calls, or server-only environment access. Manual review found stored cross-site scripting, missing authorization, mass assignment, and draft disclosure in the supplied examples. These examples require security hardening before publication.","remediation":[{"issue":"The blog example renders stored post content through dangerouslySetInnerHTML without sanitization.","severity":"high","suggestion":"Sanitize HTML with a strict server-side allowlist before storage or rendering. Prefer a renderer that escapes raw HTML by default."},{"issue":"Several mutating Server Actions omit authentication, authorization, and ownership checks.","severity":"high","suggestion":"Authenticate every action, enforce resource ownership or roles, and scope database mutations to the authorized principal."},{"issue":"Resource update actions pass caller-provided Partial<Resource> values directly to Prisma.","severity":"high","suggestion":"Validate update payloads with a strict schema and map only approved fields into database operations."},{"issue":"The public blog detail query does not require published status.","severity":"medium","suggestion":"Filter public queries by published status. Allow draft access only after an explicit author or administrator authorization check."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"examples/blog-app-example.tsx","line_end":93,"line_start":93},{"file":"examples/blog-app-example.tsx","line_end":118,"line_start":118},{"file":"examples/blog-app-example.tsx","line_end":226,"line_start":226},{"file":"examples/blog-app-example.tsx","line_end":424,"line_start":424},{"file":"references/component-patterns.md","line_end":62,"line_start":61},{"file":"references/component-patterns.md","line_end":67,"line_start":62},{"file":"references/component-patterns.md","line_end":422,"line_start":417},{"file":"references/server-actions.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":80,"line_start":68},{"file":"SKILL.md","line_end":83,"line_start":80},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":87},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":107,"line_start":98},{"file":"SKILL.md","line_end":109,"line_start":107},{"file":"SKILL.md","line_end":113,"line_start":109},{"file":"SKILL.md","line_end":124,"line_start":113},{"file":"SKILL.md","line_end":140,"line_start":124},{"file":"SKILL.md","line_end":147,"line_start":140},{"file":"SKILL.md","line_end":152,"line_start":147},{"file":"SKILL.md","line_end":157,"line_start":152},{"file":"SKILL.md","line_end":160,"line_start":157},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":167,"line_start":164},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":173,"line_start":171},{"file":"SKILL.md","line_end":186,"line_start":173},{"file":"SKILL.md","line_end":201,"line_start":186},{"file":"SKILL.md","line_end":212,"line_start":201},{"file":"SKILL.md","line_end":220,"line_start":212},{"file":"SKILL.md","line_end":244,"line_start":220},{"file":"SKILL.md","line_end":245,"line_start":244},{"file":"SKILL.md","line_end":246,"line_start":245},{"file":"SKILL.md","line_end":254,"line_start":246},{"file":"SKILL.md","line_end":267,"line_start":254},{"file":"SKILL.md","line_end":283,"line_start":267},{"file":"SKILL.md","line_end":300,"line_start":283},{"file":"SKILL.md","line_end":304,"line_start":300},{"file":"SKILL.md","line_end":317,"line_start":304},{"file":"SKILL.md","line_end":321,"line_start":317},{"file":"SKILL.md","line_end":334,"line_start":321},{"file":"SKILL.md","line_end":340,"line_start":334},{"file":"SKILL.md","line_end":340,"line_start":340},{"file":"SKILL.md","line_end":344,"line_start":343}]},{"factor":"scripts","evidence":[{"file":"references/component-patterns.md","line_end":375,"line_start":375}]},{"factor":"network","evidence":[{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/migration-guide.md","line_end":54,"line_start":54},{"file":"references/migration-guide.md","line_end":72,"line_start":72},{"file":"references/migration-guide.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":375,"line_start":375},{"file":"SKILL.md","line_end":376,"line_start":376},{"file":"SKILL.md","line_end":377,"line_start":377},{"file":"SKILL.md","line_end":378,"line_start":378},{"file":"templates/client-component-template.tsx","line_end":41,"line_start":41}]},{"factor":"env_access","evidence":[{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[{"title":"Stored Cross-Site Scripting in Blog Example","locations":[{"file":"examples/blog-app-example.tsx","line_end":89,"line_start":69},{"file":"examples/blog-app-example.tsx","line_end":279,"line_start":276}],"confidence":0.98,"description":"The blog example stores author-supplied post content and renders it as raw HTML without sanitization. Script-bearing content could execute in readers' browsers.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The input schema accepts unrestricted content, stores it, and later passes it directly to dangerouslySetInnerHTML. No sanitization step appears in the example."},{"title":"Missing Authorization in Mutating Server Actions","locations":[{"file":"templates/server-action-template.ts","line_end":50,"line_start":30},{"file":"templates/server-action-template.ts","line_end":142,"line_start":110},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151},{"file":"templates/server-action-template.ts","line_end":205,"line_start":174},{"file":"templates/server-action-template.ts","line_end":236,"line_start":219}],"confidence":0.98,"description":"Several exported Server Actions create, delete, toggle, bulk-update, upload, or revalidate without authentication or authorization. Remote callers could abuse these mutation endpoints.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"These functions are exported from a use-server module and perform privileged operations without calling the session or ownership checks shown in updateResource."},{"title":"Mass Assignment in Resource Update Actions","locations":[{"file":"templates/server-action-template.ts","line_end":92,"line_start":71},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151}],"confidence":0.94,"description":"Update actions accept Partial<Resource> and pass it directly to database operations without an allowlist schema. Callers could modify fields outside the intended form.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The exported actions accept caller-provided partial database records and use them as update data. No Zod schema or field allowlist constrains these values."}],"medium_findings":[{"title":"Unpublished Blog Posts Exposed by Slug","locations":[{"file":"examples/blog-app-example.tsx","line_end":250,"line_start":238}],"confidence":0.95,"description":"The public post page loads any post matching a slug without requiring published status. Anyone who learns a draft slug could read unpublished content.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The listing and static-parameter queries filter published posts, but the page query uses only the slug and renders the returned record without an access check."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":11,"total_lines":2709,"audit_model":"codex","audited_at":"2026-07-23T06:34:07.451+00:00","created_at":"2026-07-24T07:35:19.512859+00:00","static_findings":[{"id":"blocker:checklists/rsc-implementation-checklist.md:11:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid using React hooks in Server Components","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:checklists/rsc-implementation-checklist.md:12:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid browser APIs (window, document, localStorage) in Server Components","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:checklists/rsc-implementation-checklist.md:21:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid heavy dependencies that increase bundle size","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:checklists/rsc-implementation-checklist.md:27:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid passing functions, dates, or complex objects as props","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:checklists/rsc-implementation-checklist.md:45:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Select only required fields (avoid `SELECT *`)","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:checklists/rsc-implementation-checklist.md:48:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid waterfalls - fetch data in parallel","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:checklists/rsc-implementation-checklist.md:116:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid wrapping entire page in single Suspense","category":"blocker","line_end":116,"severity":"low","line_start":116},{"id":"blocker:checklists/rsc-implementation-checklist.md:160:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Prevent form submission if invalid","category":"blocker","line_end":161,"severity":"low","line_start":160},{"id":"blocker:checklists/rsc-implementation-checklist.md:240:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"## Common Pitfalls to Avoid","category":"blocker","line_end":242,"severity":"low","line_start":240},{"id":"blocker:checklists/rsc-implementation-checklist.md:39:network-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"Network reconnaissance","snippet":"### Database Access","category":"blocker","line_end":40,"severity":"low","line_start":39},{"id":"external_commands:examples/blog-app-example.tsx:93:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/blog/${post.slug}`)","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:examples/blog-app-example.tsx:118:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/blog/[slug]`)","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:examples/blog-app-example.tsx:226:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"description: post.excerpt || `By ${post.author.name}`,","category":"external_commands","line_end":226,"severity":"medium","line_start":226},{"id":"external_commands:examples/blog-app-example.tsx:424:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"href={`/blog/${post.slug}`}","category":"external_commands","line_end":424,"severity":"medium","line_start":424},{"id":"blocker:examples/blog-app-example.tsx:14:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"id          String   @id @default(cuid())","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:examples/blog-app-example.tsx:31:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"id        String   @id @default(cuid())","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:examples/blog-app-example.tsx:88:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"authorId: session.user.id","category":"blocker","line_end":89,"severity":"low","line_start":88},{"id":"blocker:examples/blog-app-example.tsx:114:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"authorId: session.user.id","category":"blocker","line_end":115,"severity":"low","line_start":114},{"id":"blocker:examples/blog-app-example.tsx:173:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"<div className=\"grid gap-6 md:grid-cols-2 lg:grid-cols-3\">","category":"blocker","line_end":173,"severity":"low","line_start":173},{"id":"scripts:references/component-patterns.md:375:dynamic-import-expression","file":"references/component-patterns.md","pattern":"Dynamic import() expression","snippet":"const InteractiveReviews = dynamic(() => import('@/components/InteractiveReviews'), {","category":"scripts","line_end":375,"severity":"medium","line_start":375},{"id":"external_commands:references/component-patterns.md:61:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:references/component-patterns.md:62:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"headers: { Authorization: `Bearer ${apiKey}` }","category":"external_commands","line_end":67,"severity":"medium","line_start":62},{"id":"external_commands:references/component-patterns.md:417:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"document.cookie = `theme=${newTheme}; path=/`","category":"external_commands","line_end":422,"severity":"medium","line_start":417},{"id":"network:references/component-patterns.md:61:fetch-api-call","file":"references/component-patterns.md","pattern":"Fetch API call","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:references/component-patterns.md:61:hardcoded-url","file":"references/component-patterns.md","pattern":"Hardcoded URL","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"env_access:references/component-patterns.md:59:environment-variable-access-dot-notation","file":"references/component-patterns.md","pattern":"Environment variable access (dot notation)","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:references/component-patterns.md:59:environment-variable-object","file":"references/component-patterns.md","pattern":"Environment variable object","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:references/component-patterns.md:59:generic-api-secret-keys","file":"references/component-patterns.md","pattern":"Generic API/secret keys","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"high","line_start":59},{"id":"sensitive:references/component-patterns.md:59:environment-file-access","file":"references/component-patterns.md","pattern":"Environment file access","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"sensitive","line_end":59,"severity":"high","line_start":59},{"id":"blocker:references/component-patterns.md:211:system-reconnaissance","file":"references/component-patterns.md","pattern":"System reconnaissance","snippet":"// ❌ Avoid this","category":"blocker","line_end":211,"severity":"low","line_start":211},{"id":"blocker:references/component-patterns.md:37:network-reconnaissance","file":"references/component-patterns.md","pattern":"Network reconnaissance","snippet":"// Direct database access - runs on server only","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"network:references/data-fetching.md:11:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:references/data-fetching.md:16:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:references/data-fetching.md:21:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:references/data-fetching.md:26:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:references/data-fetching.md:160:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"posts = await fetch('https://api.example.com/posts').then(res => {","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:references/data-fetching.md:11:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:references/data-fetching.md:16:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:references/data-fetching.md:21:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:references/data-fetching.md:26:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:references/data-fetching.md:160:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"posts = await fetch('https://api.example.com/posts').then(res => {","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:references/migration-guide.md:54:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"fetch('/api/posts')","category":"network","line_end":54,"severity":"low","line_start":54},{"id":"network:references/migration-guide.md:72:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"const posts = await fetch('/api/posts').then(res => res.json())","category":"network","line_end":72,"severity":"low","line_start":72},{"id":"network:references/migration-guide.md:93:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"const response = await fetch('/api/posts', {","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"blocker:references/routing-patterns.md:34:system-reconnaissance","file":"references/routing-patterns.md","pattern":"System reconnaissance","snippet":"<div className=\"grid grid-cols-2 gap-4\">","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"external_commands:references/server-actions.md:22:ruby-shell-backtick-execution","file":"references/server-actions.md","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/posts/${post.id}`)","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"blocker:references/server-actions.md:103:system-reconnaissance","file":"references/server-actions.md","pattern":"System reconnaissance","snippet":"addOptimisticTodo({ ...todos.find(t => t.id === id)!, completed: true })","category":"blocker","line_end":103,"severity":"low","line_start":103},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Can be `async` and use `await`","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Client Components** (with `'use client'`):","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Can use hooks (`useState`, `useEffect`, etc.)","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Cannot be `async`","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Rule**: Server Components can render Client Components, but Client Components cannot directly ","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Patterns**: See `references/component-patterns.md` for:","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":80,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Parallel fetching**: `Promise.all([fetch1, fetch2, fetch3])`","category":"external_commands","line_end":87,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/data-fetching.md` for:","category":"external_commands","line_end":89,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Revalidation methods (`revalidatePath`, `revalidateTag`)","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":107,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/posts/${post.id}`)","category":"external_commands","line_end":109,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":113,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/server-actions.md` for:","category":"external_commands","line_end":124,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":140,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Templates**: Use `templates/ServerComponent.tsx` for streaming patterns","category":"external_commands","line_end":152,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":160,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":167,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/routing-patterns.md` for:","category":"external_commands","line_end":186,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":201,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":212,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Pass Server Components as `children` to Client Components","category":"external_commands","line_end":220,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use `generateStaticParams` for static routes","category":"external_commands","line_end":244,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ServerComponent.tsx`** - Basic async Server Component with data fetching","category":"external_commands","line_end":245,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ClientComponent.tsx`** - Interactive Client Component with hooks","category":"external_commands","line_end":246,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ServerAction.tsx`** - Server Action with validation and revalidation","category":"external_commands","line_end":254,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/blog-app/` for a full implementation:","category":"external_commands","line_end":267,"severity":"medium","line_start":254},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `checklists/rsc-implementation.md` for comprehensive validation covering:","category":"external_commands","line_end":283,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":300,"severity":"medium","line_start":283},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":304,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":317,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":321,"severity":"medium","line_start":317},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":334,"severity":"medium","line_start":321},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":340,"severity":"medium","line_start":334},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Incremental Adoption**: Both `pages/` and `app/` can coexist","category":"external_commands","line_end":340,"severity":"medium","line_start":340},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `getServerSideProps` → async Server Component","category":"external_commands","line_end":344,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `getStaticProps` → async Server Component with caching","category":"external_commands","line_end":346,"severity":"medium","line_start":344},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `_app.tsx` → `layout.tsx`","category":"external_commands","line_end":346,"severity":"medium","line_start":346},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `<Head>` → `generateMetadata` function","category":"external_commands","line_end":347,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Migration**: See `references/migration-guide.md` for:","category":"external_commands","line_end":360,"severity":"medium","line_start":349},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Add `'use client'` directive to the component","category":"external_commands","line_end":363,"severity":"medium","line_start":360},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Add `async` to function declaration","category":"external_commands","line_end":366,"severity":"medium","line_start":363},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Pass Server Component as `children` prop instead of importing","category":"external_commands","line_end":369,"severity":"medium","line_start":366},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Use `'use client'` for components using `Date.now()`, `Math.random()`, or browser APIs","category":"external_commands","line_end":369,"severity":"medium","line_start":369},{"id":"network:SKILL.md:70:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { cache: 'force-cache' })","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:SKILL.md:73:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { next: { revalidate: 60 } })","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:SKILL.md:76:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { cache: 'no-store' })","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"network:SKILL.md:79:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { next: { tags: ['posts'] } })","category":"network","line_end":79,"severity":"low","line_start":79},{"id":"network:SKILL.md:375:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Next.js 15 Documentation](https://nextjs.org/docs)","category":"network","line_end":375,"severity":"low","line_start":375},{"id":"network:SKILL.md:376:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [React Server Components RFC](https://github.com/reactjs/rfcs/blob/main/text/0188-server-component","category":"network","line_end":376,"severity":"low","line_start":376},{"id":"network:SKILL.md:377:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [App Router Migration Guide](https://nextjs.org/docs/app/building-your-application/upgrading/app-r","category":"network","line_end":377,"severity":"low","line_start":377},{"id":"network:SKILL.md:378:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Server Actions Documentation](https://nextjs.org/docs/app/building-your-application/data-fetching","category":"network","line_end":378,"severity":"low","line_start":378},{"id":"blocker:SKILL.md:213:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- ❌ Avoid making entire pages Client Components","category":"blocker","line_end":213,"severity":"low","line_start":213},{"id":"blocker:SKILL.md:362:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Error: \"async/await is not valid in non-async Server Components\"**","category":"blocker","line_end":362,"severity":"low","line_start":362},{"id":"blocker:SKILL.md:46:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Direct database access","category":"blocker","line_end":47,"severity":"low","line_start":46},{"id":"network:templates/client-component-template.tsx:41:fetch-api-call","file":"templates/client-component-template.tsx","pattern":"Fetch API call","snippet":"const response = await fetch('/api/data')","category":"network","line_end":41,"severity":"low","line_start":41},{"id":"blocker:templates/client-component-template.tsx:19:system-reconnaissance","file":"templates/client-component-template.tsx","pattern":"System reconnaissance","snippet":"onAction?: (data: any) => void","category":"blocker","line_end":20,"severity":"low","line_start":19},{"id":"blocker:templates/client-component-template.tsx:78:system-reconnaissance","file":"templates/client-component-template.tsx","pattern":"System reconnaissance","snippet":"* 5. Avoid heavy dependencies (increases bundle size)","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"external_commands:templates/server-action-template.ts:58:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/resources/${resource.id}`)","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:templates/server-action-template.ts:95:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/resources/${id}`)","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:templates/server-action-template.ts:221:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/resources/${id}`)","category":"external_commands","line_end":221,"severity":"medium","line_start":221},{"id":"blocker:templates/server-action-template.ts:42:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"error: 'Invalid data',","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:templates/server-action-template.ts:81:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:templates/server-action-template.ts:90:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":90,"severity":"low","line_start":90},{"id":"blocker:templates/server-action-template.ts:113:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":113,"severity":"low","line_start":113},{"id":"blocker:templates/server-action-template.ts:132:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:templates/server-action-template.ts:140:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-access-dot-notation","file":"templates/server-component-template.tsx","pattern":"Environment variable access (dot notation)","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-object","file":"templates/server-component-template.tsx","pattern":"Environment variable object","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:templates/server-component-template.tsx:30:generic-api-secret-keys","file":"templates/server-component-template.tsx","pattern":"Generic API/secret keys","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:templates/server-component-template.tsx:30:environment-file-access","file":"templates/server-component-template.tsx","pattern":"Environment file access","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"blocker:templates/server-component-template.tsx:26:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"where: { categoryId: params.id }","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:templates/server-component-template.tsx:59:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"id: category.id","category":"blocker","line_end":60,"severity":"low","line_start":59},{"id":"blocker:templates/server-component-template.tsx:66:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"where: { id: params.id }","category":"blocker","line_end":66,"severity":"low","line_start":66}],"finding_verdicts":[{"id":"blocker:checklists/rsc-implementation-checklist.md:11:system-reconnaissance","reason":"\"- [ ] Avoid using React hooks in Server Components\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:12:system-reconnaissance","reason":"\"- [ ] Avoid browser APIs (window, document, localStorage) in Server Components\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:21:system-reconnaissance","reason":"\"- [ ] Avoid heavy dependencies that increase bundle size\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:27:system-reconnaissance","reason":"\"- [ ] Avoid passing functions, dates, or complex objects as props\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:45:system-reconnaissance","reason":"\"- [ ] Select only required fields (avoid `SELECT *`)\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:48:system-reconnaissance","reason":"\"- [ ] Avoid waterfalls - fetch data in parallel\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:116:system-reconnaissance","reason":"\"- [ ] Avoid wrapping entire page in single Suspense\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:160:system-reconnaissance","reason":"\"- [ ] Prevent form submission if invalid\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:240:system-reconnaissance","reason":"\"## Common Pitfalls to Avoid\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:checklists/rsc-implementation-checklist.md:39:network-reconnaissance","reason":"\"### Database Access\" describes normal application data access. It does not probe hosts, ports, services, or network configuration.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/blog-app-example.tsx:93:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/blog-app-example.tsx:118:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/blog-app-example.tsx:226:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/blog-app-example.tsx:424:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/blog-app-example.tsx:14:system-reconnaissance","reason":"\"id String @id @default(cuid())\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/blog-app-example.tsx:31:system-reconnaissance","reason":"\"id String @id @default(cuid())\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/blog-app-example.tsx:88:system-reconnaissance","reason":"\"authorId: session.user.id\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/blog-app-example.tsx:114:system-reconnaissance","reason":"\"authorId: session.user.id\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/blog-app-example.tsx:173:system-reconnaissance","reason":"\"<div className=\"grid gap-6 md:grid-cols-2 lg:grid-cols-3\">\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"scripts:references/component-patterns.md:375:dynamic-import-expression","reason":"The Next.js dynamic import uses a fixed local module alias and contains no user-controlled module path. This is standard client bundle splitting, not arbitrary code loading.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/component-patterns.md:61:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/component-patterns.md:62:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/component-patterns.md:417:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"network:references/component-patterns.md:61:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/component-patterns.md:61:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/component-patterns.md:59:environment-variable-access-dot-notation","reason":"The example reads one named secret inside a Server Component and keeps it server-side for an expected Authorization header. It does not enumerate or expose the environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/component-patterns.md:59:environment-variable-object","reason":"The example reads one named secret inside a Server Component and keeps it server-side for an expected Authorization header. It does not enumerate or expose the environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/component-patterns.md:59:generic-api-secret-keys","reason":"SECRET_API_KEY is a placeholder environment-variable name used in a server-only example. The example sends it only as the expected credential to a reserved documentation endpoint.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:references/component-patterns.md:59:environment-file-access","reason":"The code accesses process.env, not an environment file. There is no filesystem operation, .env path, credential enumeration, or secret disclosure.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/component-patterns.md:211:system-reconnaissance","reason":"\"// ❌ Avoid this\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/component-patterns.md:37:network-reconnaissance","reason":"\"// Direct database access - runs on server only\" describes normal application data access. It does not probe hosts, ports, services, or network configuration.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:11:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:16:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:21:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:26:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:160:fetch-api-call","reason":"This documentation example uses the reserved example.com domain to demonstrate Next.js fetching. It contains no real destination or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:11:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:16:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:21:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:26:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/data-fetching.md:160:hardcoded-url","reason":"The URL uses the reserved example.com documentation domain as a placeholder. It is not an operational endpoint or suspicious destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/migration-guide.md:54:fetch-api-call","reason":"This is an illustrative same-origin application API request. It does not transmit secrets or contact an untrusted external destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/migration-guide.md:72:fetch-api-call","reason":"This is an illustrative same-origin application API request. It does not transmit secrets or contact an untrusted external destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/migration-guide.md:93:fetch-api-call","reason":"This is an illustrative same-origin application API request. It does not transmit secrets or contact an untrusted external destination.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/routing-patterns.md:34:system-reconnaissance","reason":"\"<div className=\"grid grid-cols-2 gap-4\">\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/server-actions.md:22:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/server-actions.md:103:system-reconnaissance","reason":"\"addOptimisticTodo({ ...todos.find(t => t.id === id)!, completed: true })\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:70:fetch-api-call","reason":"This generic documentation snippet demonstrates Next.js fetch caching and revalidation options. No destination, sensitive payload, or unauthorized request is defined.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:73:fetch-api-call","reason":"This generic documentation snippet demonstrates Next.js fetch caching and revalidation options. No destination, sensitive payload, or unauthorized request is defined.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:76:fetch-api-call","reason":"This generic documentation snippet demonstrates Next.js fetch caching and revalidation options. No destination, sensitive payload, or unauthorized request is defined.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:79:fetch-api-call","reason":"This generic documentation snippet demonstrates Next.js fetch caching and revalidation options. No destination, sensitive payload, or unauthorized request is defined.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:375:hardcoded-url","reason":"The URL is a user-facing link to official Next.js or React documentation. A documentation hyperlink is not an automatic network request or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:376:hardcoded-url","reason":"The URL is a user-facing link to official Next.js or React documentation. A documentation hyperlink is not an automatic network request or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:377:hardcoded-url","reason":"The URL is a user-facing link to official Next.js or React documentation. A documentation hyperlink is not an automatic network request or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:378:hardcoded-url","reason":"The URL is a user-facing link to official Next.js or React documentation. A documentation hyperlink is not an automatic network request or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:213:system-reconnaissance","reason":"\"- ❌ Avoid making entire pages Client Components\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:362:system-reconnaissance","reason":"\"**Error: \"async/await is not valid in non-async Server Components\"**\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:46:network-reconnaissance","reason":"\"- Direct database access\" describes normal application data access. It does not probe hosts, ports, services, or network configuration.","verdict":"false_positive","confidence":0.98},{"id":"network:templates/client-component-template.tsx:41:fetch-api-call","reason":"This is an illustrative same-origin application API request. It does not transmit secrets or contact an untrusted external destination.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/client-component-template.tsx:19:system-reconnaissance","reason":"\"onAction?: (data: any) => void\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/client-component-template.tsx:78:system-reconnaissance","reason":"\"* 5. Avoid heavy dependencies (increases bundle size)\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:templates/server-action-template.ts:58:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:templates/server-action-template.ts:95:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:templates/server-action-template.ts:221:ruby-shell-backtick-execution","reason":"The backticks are JavaScript template literals or Markdown code formatting. The surrounding content does not invoke a shell, process API, or command interpreter.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:42:system-reconnaissance","reason":"\"error: 'Invalid data',\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:81:system-reconnaissance","reason":"\"where: { id }\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:90:system-reconnaissance","reason":"\"where: { id },\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:113:system-reconnaissance","reason":"\"where: { id }\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:132:system-reconnaissance","reason":"\"where: { id }\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-action-template.ts:140:system-reconnaissance","reason":"\"where: { id },\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-access-dot-notation","reason":"The server-only template reads one named placeholder variable into a local value and does not return, log, or transmit it. It does not enumerate the environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-object","reason":"The server-only template reads one named placeholder variable into a local value and does not return, log, or transmit it. It does not enumerate the environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:templates/server-component-template.tsx:30:generic-api-secret-keys","reason":"SECRET_API_KEY is a placeholder environment-variable name in a Server Component template. No credential value is embedded, logged, returned, or transmitted.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:templates/server-component-template.tsx:30:environment-file-access","reason":"The code accesses process.env, not an environment file. There is no filesystem operation, .env path, credential enumeration, or secret disclosure.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-component-template.tsx:26:system-reconnaissance","reason":"\"where: { categoryId: params.id }\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-component-template.tsx:59:system-reconnaissance","reason":"\"id: category.id\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98},{"id":"blocker:templates/server-component-template.tsx:66:system-reconnaissance","reason":"\"where: { id: params.id }\" is ordinary React, database, layout, validation, or checklist content. It performs no host, process, filesystem, or configuration discovery.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Stored Cross-Site Scripting in Blog Example","severity":"high","locations":[{"file":"examples/blog-app-example.tsx","line_end":89,"line_start":69},{"file":"examples/blog-app-example.tsx","line_end":279,"line_start":276}],"confidence":0.98,"description":"The blog example stores author-supplied post content and renders it as raw HTML without sanitization. Script-bearing content could execute in readers' browsers.","confidence_reasoning":"The input schema accepts unrestricted content, stores it, and later passes it directly to dangerouslySetInnerHTML. No sanitization step appears in the example."},{"title":"Missing Authorization in Mutating Server Actions","severity":"high","locations":[{"file":"templates/server-action-template.ts","line_end":50,"line_start":30},{"file":"templates/server-action-template.ts","line_end":142,"line_start":110},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151},{"file":"templates/server-action-template.ts","line_end":205,"line_start":174},{"file":"templates/server-action-template.ts","line_end":236,"line_start":219}],"confidence":0.98,"description":"Several exported Server Actions create, delete, toggle, bulk-update, upload, or revalidate without authentication or authorization. Remote callers could abuse these mutation endpoints.","confidence_reasoning":"These functions are exported from a use-server module and perform privileged operations without calling the session or ownership checks shown in updateResource."},{"title":"Mass Assignment in Resource Update Actions","severity":"high","locations":[{"file":"templates/server-action-template.ts","line_end":92,"line_start":71},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151}],"confidence":0.94,"description":"Update actions accept Partial<Resource> and pass it directly to database operations without an allowlist schema. Callers could modify fields outside the intended form.","confidence_reasoning":"The exported actions accept caller-provided partial database records and use them as update data. No Zod schema or field allowlist constrains these values."},{"title":"Unpublished Blog Posts Exposed by Slug","severity":"medium","locations":[{"file":"examples/blog-app-example.tsx","line_end":250,"line_start":238}],"confidence":0.95,"description":"The public post page loads any post matching a slug without requiring published status. Anyone who learns a draft slug could read unpublished content.","confidence_reasoning":"The listing and static-parameter queries filter published posts, but the page query uses only the slug and renders the returned record without an access check."}],"subject_marketplace_commit_sha":"89edfdc710d0846129dcee6a929477b04f08052c","subject_content_hash":"ab5326747954a20452345872dc6ad27c82203cb27bad51e6c9c2a3209738714c","subject_tree_hash":"e0d302990ff398d94abad11bc0d30d3ade8a064f50aca3ba7ff5f4b6f1caff49","subject_plugin_path":"skills/ariegoldkin/react-server-components-framework","audit_payload_hash":"52c64c33b7182802e7ee1b8ae0bf55c9","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"89edfdc710d0846129dcee6a929477b04f08052c","contentHash":"ab5326747954a20452345872dc6ad27c82203cb27bad51e6c9c2a3209738714c","treeHash":"e0d302990ff398d94abad11bc0d30d3ade8a064f50aca3ba7ff5f4b6f1caff49","pluginPath":"skills/ariegoldkin/react-server-components-framework","auditPayloadHash":"52c64c33b7182802e7ee1b8ae0bf55c9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/ariegoldkin-react-server-components-framework/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":4,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}