The skill is a normal Next.js upgrade workflow and contains no prompt injection or data-exfiltration language. The main risk is that it instructs agents to run unpinned npm and npx commands plus project scripts, which can execute third-party or repository-controlled code. The hardcoded URLs point to official Next.js documentation and are not suspicious.
The workflow uses @latest package invocations for codemods and dependency upgrades. This can execute newly published package code or install unexpected major versions without pinning.
The referenced lines explicitly use npm or npx with @latest. The risk is supply-chain exposure from executing or installing unpinned registry packages.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The fenced command shows npx @next/codemod@latest, which downloads and executes a package from npm. This is legitimate migration tooling, but it can run third-party code and needs user approval.
The instruction asks the agent to run npm run build and npm run dev. Those execute project-defined scripts, which is useful for validation but can run arbitrary repository code.
The skill is a normal Next.js upgrade workflow and contains no prompt injection or data-exfiltration language. The main risk is that it instructs agents to run unpinned npm and npx commands plus project scripts, which can execute third-party or repository-controlled code. The hardcoded URLs point to official Next.js documentation and are not suspicious.
The workflow uses @latest package invocations for codemods and dependency upgrades. This can execute newly published package code or install unexpected major versions without pinning.
The referenced lines explicitly use npm or npx with @latest. The risk is supply-chain exposure from executing or installing unpinned registry packages.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The fenced command shows npx @next/codemod@latest, which downloads and executes a package from npm. This is legitimate migration tooling, but it can run third-party code and needs user approval.
The instruction asks the agent to run npm run build and npm run dev. Those execute project-defined scripts, which is useful for validation but can run arbitrary repository code.
The skill contains no prompt injection or evidence of malicious exfiltration. Several static findings are markdown false positives, but real package manager and script commands remain. Those commands can execute project or downloaded package code; the URLs point to official Next.js documentation.
1
Files scanned
50
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static command and network findings are partly confirmed: the skill instructs agents to fetch official Next.js documentation and run npm or npx upgrade commands in a user project. The weak cryptography alerts are false positives; no cryptographic API, weak algorithm choice, prompt injection, or malicious intent was found in SKILL.md.
1
Files scanned
50
Lines analyzed
5
Review items
1
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs agents to run npx codemods and npm install commands. This is expected for a Next.js upgrade workflow, but it can execute third-party package code and modify project dependencies.
The commands are explicit and operational, and package-manager execution can change project state. The context is legitimate migration work, so this is moderate risk rather than malicious.
The skill asks agents to fetch Next.js upgrade documentation from nextjs.org. This network access is relevant to the task and points to official documentation, but it should still be visible to users.
The URLs are explicit and all point to nextjs.org documentation. No evidence of credential transfer, tracking endpoints, or unrelated domains was found.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The static weak-cryptography alerts do not correspond to cryptographic code. The cited lines are front matter, prose, or upgrade instructions, with no hashing, encryption, or algorithm selection present.
Manual review of the cited lines shows no cryptographic primitive or security-sensitive algorithm. The matches appear to be pattern noise from upgrade-related text.
Static command and network findings are partly confirmed: the skill instructs agents to fetch official Next.js documentation and run npm or npx upgrade commands in a user project. The weak cryptography alerts are false positives; no cryptographic API, weak algorithm choice, prompt injection, or malicious intent was found in SKILL.md.
1
Files scanned
50
Lines analyzed
5
Review items
1
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs agents to run npx codemods and npm install commands. This is expected for a Next.js upgrade workflow, but it can execute third-party package code and modify project dependencies.
The commands are explicit and operational, and package-manager execution can change project state. The context is legitimate migration work, so this is moderate risk rather than malicious.
The skill asks agents to fetch Next.js upgrade documentation from nextjs.org. This network access is relevant to the task and points to official documentation, but it should still be visible to users.
The URLs are explicit and all point to nextjs.org documentation. No evidence of credential transfer, tracking endpoints, or unrelated domains was found.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The static weak-cryptography alerts do not correspond to cryptographic code. The cited lines are front matter, prose, or upgrade instructions, with no hashing, encryption, or algorithm selection present.
Manual review of the cited lines shows no cryptographic primitive or security-sensitive algorithm. The matches appear to be pattern noise from upgrade-related text.