此報告尚無所請求語言的翻譯，目前顯示規範英文報告。
版本化安全評估
報告編號: SA-CB88FBDE
7/5/2026, 1:57:22 AM
nextjs-devtools 安全評估 v7
Skill 安全認證報告
稽核模型: codex 歷史報告
- 技能名稱
- nextjs-devtools
- 版本
- v7
- 維護者
- Asmayaseen
- 涵蓋範圍
- 3 已掃描檔案 · 602 分析行數
- 策略版本
- 無法使用
已確認問題的最高嚴重性
高
有 1 個已確認的安全問題需要處理。
安裝情境
歷史證據
本報告可能無法描述目前可安裝的 artifact。請開啟目前的 Skill 詳情頁查看安裝建議。
開啟目前的 Skill 詳情頁本報告不會阻止或授權 manifest 或 ZIP。
Most markdown backtick and system-reconnaissance alerts are false positives from documentation formatting or MCP request identifiers. The real risks are shell-based stdio process launch, HTTP MCP connectivity, and unpinned npx package execution. No prompt-injection language was found in the reviewed files.
報告位置
歷史報告
使用本報告安裝前，請先查看稽核歷史。
稽核證明
無法簽發證明
所需的不可變繫結不完整。
人工驗證
未進行人工驗證
本報告沒有人工作驗證記錄。
涵蓋範圍
3 已掃描檔案 · 602 分析行數
有 16 項內容需要查看
限制
本報告不聲稱已進行執行階段或沙箱執行，也不證明不存在副作用。
證據鏈
證據從來源綁定延伸至安裝契約。證據可用於驗證，但並非安全保證。
來源
綁定不可用
構件
身分資訊不完整
稽核
已完成
觀察到的能力
「已觀察到」表示本報告記錄了支持證據；「未記錄」不證明該能力不存在。
包含腳本
可能執行 Skill 隨附的程式碼。
此次稽核未記錄
網路存取
可能連線至外部服務。
在 12 個證據位置觀察到
檔案系統存取
可能讀取或寫入本機檔案。
此次稽核未記錄
環境變數
可能讀取處理程序環境中的值。
此次稽核未記錄
外部命令
可能叫用 Skill 以外的命令或程式。
在 25 個證據位置觀察到
能力複核項目 (15)
高
Python subprocess.Popen
self._process = subprocess.Popen(
StdioTransport starts a command string with subprocess.Popen and shell=True. The command comes from --stdio, so unsafe input can become shell execution.
中
Unix shell invocation
#!/bin/bash
The file is an executable shell script and is intended to launch an external MCP server process. The shebang itself is benign, but the script capability is real.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
```bash
The code block instructs users or agents to run shell commands, including the MCP client or npx package launch. In a skill, these instructions can drive command execution.
中
Ruby/shell backtick execution
| Server not starting | Check `npx next-devtools-mcp@latest` works manually |
The troubleshooting text tells users to check the npx MCP package command manually. It is documentation, but it still encourages external package execution.
低
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
HTTPTransport sends JSON-RPC requests to a configured MCP URL with optional headers. This is expected behavior, but it is real network egress.
低
HTTP client library
result = self.transport.request("tools/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("tools/call", params)
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("resources/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
HTTP client library
result = self.transport.request("prompts/list")
This high-level MCP request can route through HTTPTransport when --url is used. The behavior is legitimate, but it can send MCP data over the network.
低
Python HTTP libraries
from urllib.request import Request, urlopen
The urllib import supports HTTPTransport, which performs POST requests to configured MCP servers. This confirms a legitimate network capability.
風險問題
已確認的安全問題與仍需審核的項目分開顯示。
已確認的安全問題 (1)
RISK-001 高
Unpinned Remote Package Execution
The skill instructs users and agents to run npx next-devtools-mcp@latest, and the start script launches the same unpinned package. This creates supply-chain risk because future package versions can change without review.
The unpinned npx package appears in both runnable script and skill instructions. I found no version pin, checksum, or provenance control.
補救措施
本次稽核記錄了建議的修復措施。實施這些措施是維護者的責任。
- FIX-001高Stdio transport runs a command string through shell=True.Parse the stdio command into an argument list, disable shell=True, and allow only reviewed MCP server commands.
- FIX-002高The skill launches next-devtools-mcp with @latest.Pin an exact package version and document package provenance before recommending automated execution.
- FIX-003中HTTP transport can send MCP requests and headers to configured URLs.Default to localhost, warn before remote URLs, and avoid passing secrets in headers or parameters.
- FIX-004中Skill documentation encourages command execution without an explicit safety note.Add a clear confirmation step before commands that start processes or install npm packages.
專家證據
不可變主體身分、掃描器中繼資料、已排除的相符項目和原始碼層級證據。
Artifact 主體
- Marketplace 提交
- 無法使用
- 內容雜湊
- 無法使用
- 目錄樹雜湊
- 無法使用
- Skill 路徑
- 無法使用
- 稽核承載資料雜湊
- 無法使用
分析中繼資料
稽核模型: codex
分析狀態: 已完成
範圍僅限於已記錄的檔案、行數、方法和證據；本報告不聲稱進行了執行階段或沙箱執行。
驗證與匯出
manifest 和 lockfile 將安裝 artifact 綁定到加密雜湊。該完整性聲明獨立於安全評估。
稽核證明: not_attestable