审计历史

Static analysis reported many command, network, environment, and sensitive-data patterns, but most are Markdown examples or public starter-code samples. No prompt injection, credential exfiltration, obfuscation, or confirmed malicious intent was found. The skill should publish with a medium warning because the included PowerShell bootstrap script and documented commands execute package-manager operations when users run them.

All 849 static findings are false positives. The skill is a legitimate Next.js 16 documentation resource. External commands, network calls, and crypto references are all from markdown documentation showing code examples, not actual executable code with security implications.

All 849 static findings are false positives. The skill is a legitimate Next.js 16 documentation resource. External commands, network calls, and crypto references are all from markdown documentation showing code examples, not actual executable code with security implications.

This skill contains documentation and reference code for Next.js 16 development. A PowerShell bootstrap script is included for project setup but only runs standard Node.js/npm commands. No malicious behavior, data exfiltration, or credential theft detected.

This skill contains documentation and reference code for Next.js 16 development. A PowerShell bootstrap script is included for project setup but only runs standard Node.js/npm commands. No malicious behavior, data exfiltration, or credential theft detected.

This skill contains documentation and reference code for Next.js 16 development. A PowerShell bootstrap script is included for project setup but only runs standard Node.js/npm commands. No malicious behavior, data exfiltration, or credential theft detected.