{"data":{"skill":{"slug":"vercel-labs-next-upgrade","name":"next-upgrade","icon":"📦","repo":"https://github.com/vercel-labs/next-skills/tree/main/skills/next-upgrade/","status":"approved","author":"vercel-labs","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"ef00ed9f-9848-4ae3-bf34-689043af9e84","skill_id":"c12bc3ce-8b41-4d3f-bcd2-630c2bf3a8dd","version":6,"content_hash":"v3:26421118b848d9f1efc0aa169d8a7a9e7e0a877e:775f91eaffc1a0caa5b8fff2524f8493cc6f0cbf87bac4fbafcdffe2e7a4a62e:19aee1ef70ce5e1b13e562f34a845d78b5013380a91e428dd42d9a8c38dd346c:736b696c6c732f76657263656c2d6c6162732f6e6578742d75706772616465:cfec342ff132d56462cfebe4646971b8","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The skill is a normal Next.js upgrade workflow and contains no prompt injection or data-exfiltration language. The main risk is that it instructs agents to run unpinned npm and npx commands plus project scripts, which can execute third-party or repository-controlled code. The hardcoded URLs point to official Next.js documentation and are not suspicious.","remediation":[{"issue":"Unpinned codemod execution","severity":"medium","suggestion":"Ask for user confirmation before npx execution and prefer pinned @next/codemod versions after checking the official guide."},{"issue":"Dependency upgrades use @latest","severity":"medium","suggestion":"Resolve target versions from the migration guide and present dependency changes before installing packages."},{"issue":"Project scripts may execute repository code","severity":"medium","suggestion":"Show the scripts that npm run build and npm run dev will execute, then request user approval."},{"issue":"External documentation fetches are required","severity":"low","suggestion":"Keep WebFetch limited to official Next.js documentation and avoid sending project source or secrets in requests."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":28,"line_start":26},{"file":"SKILL.md","line_end":29,"line_start":28},{"file":"SKILL.md","line_end":30,"line_start":29},{"file":"SKILL.md","line_end":33,"line_start":30},{"file":"SKILL.md","line_end":35,"line_start":33},{"file":"SKILL.md","line_end":39,"line_start":35},{"file":"SKILL.md","line_end":43,"line_start":39},{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":48,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":48}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":24}],"confidence":0.86,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command shows npx @next/codemod@latest, which downloads and executes a package from npm. This is legitimate migration tooling, but it can run third-party code and needs user approval."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":35,"line_start":33}],"confidence":0.82,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command tells the agent to run npm install next@latest react@latest react-dom@latest. Package installation can execute lifecycle scripts and changes project dependencies."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":45,"line_start":43}],"confidence":0.8,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command instructs npm install for @types packages with @latest. It changes dependencies and should be gated by user confirmation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":49,"line_start":48}],"confidence":0.78,"description":"- Run `npm run build` to check for build errors","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The instruction asks the agent to run npm run build and npm run dev. Those execute project-defined scripts, which is useful for validation but can run arbitrary repository code."},{"title":"Unpinned Package Execution in Upgrade Workflow","locations":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":44,"line_start":44}],"confidence":0.86,"description":"The workflow uses @latest package invocations for codemods and dependency upgrades. This can execute newly published package code or install unexpected major versions without pinning.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The referenced lines explicitly use npm or npx with @latest. The risk is supply-chain exposure from executing or installing unpinned registry packages."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":50,"audit_model":"codex","audited_at":"2026-07-09T14:10:36.045+00:00","created_at":"2026-07-16T01:23:51.557732+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Detect current version**: Read `package.json` to identify the current Next.js version and relat","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `next-async-request-api` - Updates async Request APIs (v15)","category":"external_commands","line_end":29,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `next-request-geo-ip` - Migrates geo/ip properties (v15)","category":"external_commands","line_end":30,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `next-dynamic-access-named-export` - Transforms dynamic imports (v15)","category":"external_commands","line_end":33,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":35,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Configuration changes in `next.config.js`","category":"external_commands","line_end":43,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Run `npm run build` to check for build errors","category":"external_commands","line_end":49,"severity":"medium","line_start":48},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Codemods: https://nextjs.org/docs/app/building-your-application/upgrading/codemods","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://nextjs.org/docs/app/building-your-application/upgrading/version-15","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://nextjs.org/docs/app/building-your-application/upgrading/version-14","category":"network","line_end":19,"severity":"low","line_start":19}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The line only instructs the agent to read package.json, and the backticks are Markdown inline formatting. It does not execute a shell command or interpolate user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The fenced command shows npx @next/codemod@latest, which downloads and executes a package from npm. This is legitimate migration tooling, but it can run third-party code and needs user approval.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This location is a Markdown fence terminator near prose that names codemod transforms. It is not a runnable shell command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticks format a codemod transform name in documentation. No command is executed from this line.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The backticks format a codemod transform name in documentation. No shell execution or command interpolation appears here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The line documents a transform identifier using Markdown code formatting. It does not instruct direct command execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The fenced command tells the agent to run npm install next@latest react@latest react-dom@latest. Package installation can execute lifecycle scripts and changes project dependencies.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"This finding starts at a Markdown fence terminator and nearby prose about manual review. It is not direct shell execution.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks identify the next.config.js file name in prose. This is documentation formatting, not command execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The fenced command instructs npm install for @types packages with @latest. It changes dependencies and should be gated by user confirmation.","verdict":"confirmed","severity":"medium","confidence":0.8},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This line is only a Markdown code fence terminator. It does not contain a command or executable code.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The instruction asks the agent to run npm run build and npm run dev. Those execute project-defined scripts, which is useful for validation but can run arbitrary repository code.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URL points to official Next.js codemod documentation for read-only WebFetch use. No project data or secrets are sent to the site.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The URL points to an official Next.js version-specific upgrade guide. This is transparent documentation retrieval, not data exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:19:hardcoded-url","reason":"The URL points to an official Next.js version-specific upgrade guide. This is a safe documentation reference with no sensitive outbound payload.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[{"title":"Unpinned Package Execution in Upgrade Workflow","severity":"medium","locations":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":44,"line_start":44}],"confidence":0.86,"description":"The workflow uses @latest package invocations for codemods and dependency upgrades. This can execute newly published package code or install unexpected major versions without pinning.","confidence_reasoning":"The referenced lines explicitly use npm or npx with @latest. The risk is supply-chain exposure from executing or installing unpinned registry packages."}],"subject_marketplace_commit_sha":"26421118b848d9f1efc0aa169d8a7a9e7e0a877e","subject_content_hash":"775f91eaffc1a0caa5b8fff2524f8493cc6f0cbf87bac4fbafcdffe2e7a4a62e","subject_tree_hash":"19aee1ef70ce5e1b13e562f34a845d78b5013380a91e428dd42d9a8c38dd346c","subject_plugin_path":"skills/vercel-labs/next-upgrade","audit_payload_hash":"cfec342ff132d56462cfebe4646971b8","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"26421118b848d9f1efc0aa169d8a7a9e7e0a877e","contentHash":"775f91eaffc1a0caa5b8fff2524f8493cc6f0cbf87bac4fbafcdffe2e7a4a62e","treeHash":"19aee1ef70ce5e1b13e562f34a845d78b5013380a91e428dd42d9a8c38dd346c","pluginPath":"skills/vercel-labs/next-upgrade","auditPayloadHash":"cfec342ff132d56462cfebe4646971b8"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}