سجل التدقيق - frontend-nextjs-app-router

إصدار التدقيق 7

الأحدث مخاطر متوسطة

Jun 28, 2026, 12:25 PM

Static analysis reported many severe patterns, but review found they are almost entirely Markdown and TypeScript documentation false positives. No malicious intent, prompt injection, executable scripts, credential collection, or data exfiltration was found. The skill has medium risk because several examples can encourage under-validated server actions, route handlers, and route protection patterns.

2

الملفات التي تم فحصها

649

الأسطر التي تم تحليلها

6

Review items

0

False positives ignored

Confirmed security concerns (6)

متوسط

references/app-router-patterns.md:14-17 SKILL.md:382-385

Examples Omit Input Validation For Server-Side Mutations

TRUE POSITIVE semantic concern. Server Action and route handler examples read form or request body data and pass it to database helpers without showing validation, authorization, or error handling. The snippets are documentation, not active code, but they may lead generated applications to accept unsafe input.

The examples clearly show unvalidated mutation inputs in server-side contexts. Confidence is not higher because the code is illustrative documentation and helper functions may validate internally.

متوسط

references/app-router-patterns.md:117-123 SKILL.md:205-210

Simplified Route Protection Examples May Encourage Weak Auth

TRUE POSITIVE semantic concern. The middleware example only checks whether a token cookie exists before allowing protected routes. The admin page example checks a session role but does not show session integrity validation, creating a risk that users copy incomplete authorization patterns.

The snippets are demonstrably incomplete for production authorization. Confidence is limited because they may be abbreviated examples rather than a full auth implementation.

منخفض

SKILL.md:15-25 SKILL.md:391-401 references/app-router-patterns.md:7-34 references/app-router-patterns.md:170-184

External Command Findings Are Markdown False Positives

FALSE POSITIVE. The many reported Ruby or shell backtick findings come from Markdown code fences, inline route paths, JSX template literals, and TypeScript examples. I found no instruction that executes shell commands or asks the assistant to run untrusted commands.

The cited lines are documentation syntax and TypeScript examples, not executable Ruby or shell code. The skill contains only Markdown files.

منخفض

SKILL.md:3-4 SKILL.md:31-34 SKILL.md:116-119 SKILL.md:338-341 references/app-router-patterns.md:206-209

Weak Cryptography Findings Are Text-Match False Positives

FALSE POSITIVE. The reported weak cryptographic algorithm locations contain ordinary words such as description or design-related prose, not MD5, SHA-1, DES, or cryptographic API usage. No evidence found of weak cryptography instructions.

Targeted review found no cryptographic algorithm references at the flagged locations. The matches appear to be substring-based analyzer noise.

منخفض

SKILL.md:15-19 SKILL.md:173-176

Network, Storage, And Path Traversal Findings Are Benign Documentation

FALSE POSITIVE. The fetch, localStorage, and /app/.../page.tsx references describe normal Next.js and browser concepts. They do not collect credentials, access files, traverse paths, or make external network requests from the skill itself.

The flagged tokens are explanatory framework terms inside Markdown. No executable file access, browser storage access, or outbound request code exists in the skill package.

منخفض

SKILL.md:15-22 SKILL.md:173-176 references/app-router-patterns.md:117-123

Critical Heuristic Combinations Are Not Confirmed

FALSE POSITIVE. The static heuristic combined unrelated documentation terms and examples into a dangerous pattern. Review found no credential access, exfiltration endpoint, obfuscation, executable script, or prompt injection attempt.

Manual review of the referenced files showed only instructional Markdown and short Next.js examples. The dangerous combination is not semantically present.

دقّقه: codex

إصدار التدقيق 6

آمن

Jan 21, 2026, 04:52 PM

This skill is a documentation and guidance resource for Next.js App Router development. All 131 static findings are false positives - they are TypeScript/JavaScript code examples in markdown documentation files. No executable code, network access, or filesystem operations are performed by this skill.

3

الملفات التي تم فحصها

1,977

الأسطر التي تم تحليلها

3

Review items

0

False positives ignored

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

دقّقه: claude

إصدار التدقيق 5

مخاطر متوسطة Audit incomplete

Jan 16, 2026, 06:00 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Manual review required

This audit did not complete successfully. The quality score is capped until a successful audit is available.

3

الملفات التي تم فحصها

838

الأسطر التي تم تحليلها

4

Review items

0

False positives ignored

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

الأنماط المكتشفة

Ruby/shell backtick executionWeak cryptographic algorithmSystem reconnaissanceFetch API callPath traversal sequenceBrowser storage access[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

دقّقه: claude

إصدار التدقيق 4

مخاطر متوسطة Audit incomplete

Jan 16, 2026, 06:00 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Manual review required

This audit did not complete successfully. The quality score is capped until a successful audit is available.

3

الملفات التي تم فحصها

838

الأسطر التي تم تحليلها

4

Review items

0

False positives ignored

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

الأنماط المكتشفة

Ruby/shell backtick executionWeak cryptographic algorithmSystem reconnaissanceFetch API callPath traversal sequenceBrowser storage access[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

دقّقه: claude

إصدار التدقيق 3

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

Review items

0

False positives ignored

لم تُكتشف مشكلات أمنية

دقّقه: claude

إصدار التدقيق 2

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

Review items

0

False positives ignored

لم تُكتشف مشكلات أمنية

دقّقه: claude

إصدار التدقيق 1

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

Review items

0

False positives ignored

لم تُكتشف مشكلات أمنية

دقّقه: claude