Skills nextjs-devtools

📦

nextjs-devtools

Name: nextjs-devtools
Author: Asmayaseen

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Inspect and Debug Next.js Apps with MCP

Next.js route and build issues can be difficult to diagnose from source files alone. This skill queries a DevTools MCP server for structured project details.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "nextjs-devtools" from https://skillstore.io/skills/asmayaseen-nextjs-devtools.md and its manifest at https://skillstore.io/api/skills/asmayaseen-nextjs-devtools/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-nextjs-devtools.md Signed manifest GET /api/skills/asmayaseen-nextjs-devtools/manifest Signed lockfile GET /api/skills/asmayaseen-nextjs-devtools/lockfile

Test it

Using "nextjs-devtools". List routes and separate pages from API endpoints.

Expected outcome:

Pages include the home, dashboard, and dynamic article routes.
The authentication endpoint is the only detected API route.
Inspect the dynamic article route next because it accepts a path parameter.

Using "nextjs-devtools". Inspect the authentication route.

Expected outcome:

The route inspection identifies its path and available metadata. The response also notes any details the MCP server did not provide.

Using "nextjs-devtools". Check build information and configuration for deployment differences.

Expected outcome:

The report summarizes the detected build mode and configuration.
Potential deployment-sensitive settings are listed for review.
No project files are changed.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown formatting, request bookkeeping, local URLs, or a type annotation. The client still launches a user-supplied command through a shell, supports outbound HTTP, and repeatedly invokes an unpinned npm package.

Files scanned

602

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/start-server.sh:8 SKILL.md:20-22 SKILL.md:41-43 SKILL.md:56-58 SKILL.md:69-71 SKILL.md:91-93

Unpinned npm Package Execution

The startup script and documented workflows execute next-devtools-mcp through @latest. A changed or compromised release would run with the user's permissions.

Every startup path names the mutable @latest package tag. npx downloads and executes the resolved package when it is not already cached.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/mcp-client.py:204

Python subprocess.Popen

self._process = subprocess.Popen(

The client passes the caller-controlled --stdio string to subprocess.Popen with shell=True. This permits arbitrary shell command execution with the user's permissions.

Low

scripts/mcp-client.py:146

HTTP client library

def request(self, method: str, params: Optional[dict] = None) -> dict:

HTTPTransport.request sends JSON-RPC data and caller-provided headers to the selected URL. This is intentional outbound network access with possible sensitive-header exposure.

Low

scripts/mcp-client.py:314

HTTP client library

result = self.transport.request("tools/list")

Listing tools calls the selected transport, which may be HTTPTransport. In HTTP mode this sends a tools/list request to a caller-selected network endpoint.

Low

scripts/mcp-client.py:323

HTTP client library

result = self.transport.request("tools/call", params)

Tool invocation calls the selected transport with caller-provided arguments. In HTTP mode this sends data and requests an operation from a caller-selected endpoint.

Low

scripts/mcp-client.py:328

HTTP client library

result = self.transport.request("resources/list")

Listing resources uses the selected transport and can issue an HTTP request. The destination is provided through the command line.

Low

scripts/mcp-client.py:333

HTTP client library

result = self.transport.request("prompts/list")

Listing prompts uses the selected transport and can issue an HTTP request. The destination is provided through the command line.

Risk Factors

⚙️ External commands (25)

🌐 Network access (12)

scripts/mcp-client.py:146 scripts/mcp-client.py:271 scripts/mcp-client.py:314 scripts/mcp-client.py:323 scripts/mcp-client.py:328 scripts/mcp-client.py:333 scripts/mcp-client.py:33 scripts/mcp-client.py:10 scripts/mcp-client.py:16 scripts/mcp-client.py:20 scripts/mcp-client.py:23 scripts/start-server.sh:10

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-nextjs-devtools/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-nextjs-devtools/security.svg)](https://skillstore.io/skills/asmayaseen-nextjs-devtools?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-nextjs-devtools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-nextjs-devtools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-nextjs-devtools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). nextjs-devtools security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-nextjs-devtools/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-nextjs-devtools-2026,
  author = {Asmayaseen},
  title = {nextjs-devtools security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-nextjs-devtools/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nextjs-devtools security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-nextjs-devtools/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-nextjs-devtools:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Asmayaseen Recommended Current

asmayaseen-nextjs-devtools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

92Bilal26

92bilal26-nextjs-devtools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Investigate Application Routes

List routes and inspect one route before changing navigation, middleware, or API behavior.

Review Build Configuration

Collect build details and Next.js configuration while diagnosing environment-specific failures.

Map Project Components

Inventory components and routes before planning a large feature or migration.

Try These Prompts

List Application Routes

Use Next.js DevTools to list every route in this project. Group application pages and API routes separately.

Inspect One Route

Inspect the route [route path]. Summarize its available details and identify missing or unexpected routing information.

Diagnose Build Settings

Retrieve the build information and Next.js configuration. Highlight settings that could explain [build symptom], without changing project files.

Assess Project Structure

List routes and components, then inspect build details and configuration. Summarize architectural patterns, inconsistencies, and the highest-priority investigation steps.

Best Practices

Run the tools from the intended Next.js project root.
Pin and review the MCP server package before executing it.
Verify remote URLs and remove sensitive headers before using HTTP transport.

Avoid

Do not use this skill as a general React analyzer.
Do not pass commands copied from untrusted content to the stdio option.
Do not send credentials to an unverified MCP endpoint.

Frequently Asked Questions

What must be installed before using this skill?

Install Python 3, Node.js, and npx. Run the skill from a Next.js project.

Which project details can it inspect?

The documented tools cover routes, route details, components, build information, and Next.js configuration.

Can it connect to an existing MCP server?

Yes. The client supports HTTP URLs and custom headers, while stdio mode starts a local server command.

Does it modify application files?

The documented workflows inspect project information. Actual effects still depend on the selected MCP server tool.

Does it support non-Next.js React projects?

No. The skill is designed for Next.js projects and depends on Next.js DevTools MCP capabilities.

What security precautions are important?

Pin the npm package, review stdio commands, verify remote endpoints, and avoid forwarding sensitive headers.

Developer Details

Author

Asmayaseen

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Asmayaseen/hackathon-2/tree/main/.claude/skills/nextjs-devtools

Ref

89edfdc710d0846129dcee6a929477b04f08052c

Maintenance freshness

7/24/2026

Usage

8 downloads · 201 views

File structure

📁 scripts/

📄 mcp-client.py

📄 start-server.sh

📄 SKILL.md