سجل التدقيق - frontend-nextjs-app-router

إصدار التدقيق 7

الأحدث مخاطر متوسطة

Jun 28, 2026, 12:25 PM

Static analysis reported many severe patterns, but review found they are almost entirely Markdown and TypeScript documentation false positives. No malicious intent, prompt injection, executable scripts, credential collection, or data exfiltration was found. The skill has medium risk because several examples can encourage under-validated server actions, route handlers, and route protection patterns.

2

الملفات التي تم فحصها

649

الأسطر التي تم تحليلها

6

النتائج

codex

دقّقه

مشكلات متوسطة المخاطر (2)

references/app-router-patterns.md:14-17 SKILL.md:382-385

Examples Omit Input Validation For Server-Side Mutations

TRUE POSITIVE semantic concern. Server Action and route handler examples read form or request body data and pass it to database helpers without showing validation, authorization, or error handling. The snippets are documentation, not active code, but they may lead generated applications to accept unsafe input.

references/app-router-patterns.md:117-123 SKILL.md:205-210

Simplified Route Protection Examples May Encourage Weak Auth

TRUE POSITIVE semantic concern. The middleware example only checks whether a token cookie exists before allowing protected routes. The admin page example checks a session role but does not show session integrity validation, creating a risk that users copy incomplete authorization patterns.

مشكلات منخفضة المخاطر (4)

SKILL.md:15-25 SKILL.md:391-401 references/app-router-patterns.md:7-34 references/app-router-patterns.md:170-184

External Command Findings Are Markdown False Positives

FALSE POSITIVE. The many reported Ruby or shell backtick findings come from Markdown code fences, inline route paths, JSX template literals, and TypeScript examples. I found no instruction that executes shell commands or asks the assistant to run untrusted commands.

SKILL.md:3-4 SKILL.md:31-34 SKILL.md:116-119 SKILL.md:338-341 references/app-router-patterns.md:206-209

Weak Cryptography Findings Are Text-Match False Positives

FALSE POSITIVE. The reported weak cryptographic algorithm locations contain ordinary words such as description or design-related prose, not MD5, SHA-1, DES, or cryptographic API usage. No evidence found of weak cryptography instructions.

SKILL.md:15-19 SKILL.md:173-176

Network, Storage, And Path Traversal Findings Are Benign Documentation

FALSE POSITIVE. The fetch, localStorage, and /app/.../page.tsx references describe normal Next.js and browser concepts. They do not collect credentials, access files, traverse paths, or make external network requests from the skill itself.

SKILL.md:15-22 SKILL.md:173-176 references/app-router-patterns.md:117-123

Critical Heuristic Combinations Are Not Confirmed

FALSE POSITIVE. The static heuristic combined unrelated documentation terms and examples into a dangerous pattern. Review found no credential access, exfiltration endpoint, obfuscation, executable script, or prompt injection attempt.

إصدار التدقيق 6

آمن

Jan 21, 2026, 04:52 PM

This skill is a documentation and guidance resource for Next.js App Router development. All 131 static findings are false positives - they are TypeScript/JavaScript code examples in markdown documentation files. No executable code, network access, or filesystem operations are performed by this skill.

3

الملفات التي تم فحصها

1,977

الأسطر التي تم تحليلها

3

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

إصدار التدقيق 5

مخاطر متوسطة

Jan 16, 2026, 06:00 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

3

الملفات التي تم فحصها

838

الأسطر التي تم تحليلها

3

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

الأنماط المكتشفة

Ruby/shell backtick executionWeak cryptographic algorithmSystem reconnaissanceFetch API callPath traversal sequenceBrowser storage access[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

إصدار التدقيق 4

مخاطر متوسطة

Jan 16, 2026, 06:00 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

3

الملفات التي تم فحصها

838

الأسطر التي تم تحليلها

3

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية

عوامل الخطر

⚙️ الأوامر الخارجية (101)

🌐 الوصول إلى الشبكة (1)

SKILL.md:19

📁 الوصول إلى نظام الملفات (1)

SKILL.md:15

الأنماط المكتشفة

Ruby/shell backtick executionWeak cryptographic algorithmSystem reconnaissanceFetch API callPath traversal sequenceBrowser storage access[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

إصدار التدقيق 3

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية

إصدار التدقيق 2

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية

إصدار التدقيق 1

آمن

Jan 10, 2026, 11:07 AM

Pure documentation skill with no executable code. Contains only markdown guidance and TypeScript code templates for Next.js App Router development patterns.

2

الملفات التي تم فحصها

402

الأسطر التي تم تحليلها

0

النتائج

claude

دقّقه

لم تُكتشف مشكلات أمنية