此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-CB88FBDE
7/5/2026, 1:57:22 AM
nextjs-devtools 安全评估 v7
Skill 安全认证报告
审计模型: codex 历史报告
- 技能名称
- nextjs-devtools
- 版本
- v7
- 维护者
- Asmayaseen
- 覆盖范围
- 3 已扫描文件 · 602 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
高
有 1 个已确认的安全问题需要处理。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most markdown backtick and system-reconnaissance alerts are false positives from documentation formatting or MCP request identifiers. The real risks are shell-based stdio process launch, HTTP MCP connectivity, and unpinned npx package execution. No prompt-injection language was found in the reviewed files.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
3 已扫描文件 · 602 分析行数
有 16 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 12 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
本次审计未记录
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 25 个证据位置观察到
能力复核项 (15)
高
Python subprocess.Popen
self._process = subprocess.Popen(
StdioTransport starts a command string with subprocess.Popen and shell=True. The command comes from --stdio, so unsafe input can become shell execution.
中
Unix shell invocation
#!/bin/bash
The file is an executable shell script and is intended to launch an external MCP server process. The shebang itself is benign, but the script capability is real.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
| Server not starting | Check `npx next-devtools-mcp@latest` works manually |
The troubleshooting text tells users to check the npx MCP package command manually. It is documentation, but it still encourages external package execution.
低
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
HTTPTransport sends JSON-RPC requests to a configured MCP URL with optional headers. This is expected behavior, but it is real network egress.
低
HTTP client library
result = self.transport.request("tools/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("tools/call", params)
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("resources/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("prompts/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
Python HTTP libraries
from urllib.request import Request, urlopen
The urllib import supports HTTPTransport, which performs POST requests to configured MCP servers. This confirms a legitimate network capability.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (1)
RISK-001 高
Unpinned Remote Package Execution
The skill instructs users and agents to run npx next-devtools-mcp@latest, and the start script launches the same unpinned package. This creates supply-chain risk because future package versions can change without review.
The unpinned npx package appears in both runnable script and skill instructions. I found no version pin, checksum, or provenance control.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001高Stdio transport runs a command string through shell=True.Parse the stdio command into an argument list, disable shell=True, and allow only reviewed MCP server commands.
- FIX-002高The skill launches next-devtools-mcp with @latest.Pin an exact package version and document package provenance before recommending automated execution.
- FIX-003中HTTP transport can send MCP requests and headers to configured URLs.Default to localhost, warn before remote URLs, and avoid passing secrets in headers or parameters.
- FIX-004中Skill documentation encourages command execution without an explicit safety note.Add a clear confirmation step before commands that start processes or install npm packages.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable