技能 next-cache-components-adoption

📦

next-cache-components-adoption

Name: next-cache-components-adoption
Author: vercel

內容修訂 r1 高風險 ⚡ 包含腳本⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Adopt Next.js Cache Components Safely

Cache Components migrations can expose blocking routes and hidden rendering issues. This skill guides staged adoption, route fixes, browser checks, and final build verification.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "next-cache-components-adoption" from https://skillstore.io/skills/vercel-next-cache-components-adoption.md and its manifest at https://skillstore.io/api/skills/vercel-next-cache-components-adoption/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/vercel-next-cache-components-adoption.md 已簽名 manifest GET /api/skills/vercel-next-cache-components-adoption/manifest 已簽名 lockfile GET /api/skills/vercel-next-cache-components-adoption/lockfile

測試它

正在使用「next-cache-components-adoption」。 Assess whether this application is ready for Cache Components.

預期結果:

The application uses the App Router and meets the required Next.js version.
Two route settings need translation before the feature can be enabled.
The application must start successfully with its local database before verification.

正在使用「next-cache-components-adoption」。 Migrate the account settings feature using staged adoption.

預期結果:

The shared layout and profile page now pass development validation.
Request-specific content streams inside focused suspense boundaries.
The feature build passes, and one intentional blocking route is documented.

正在使用「next-cache-components-adoption」。 Verify the completed migration.

預期結果:

Every migrated route passes the production build. Browser checks confirm useful static shells, resolved streamed content, and no remaining undocumented opt-outs.

安全審計

高風險

v1 • 2026/7/24 開啟版本化報告

Most static alerts are false positives caused by Markdown formatting, framework identifiers, documentation links, and benign local commands. The skill still directs agents to run mutable packages and install a canary skill without approval, creating supply-chain and unauthorized-change risk. It also recommends sharing route screenshots without privacy or redaction checks.

已掃描檔案

294

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

高

SKILL.md:214

Screen capture upload

- Show, don't tell. The `next-dev-loop` session runs the browser headed, so drive the route live for

The skill directs the agent to capture and attach browser screenshots without requiring privacy review or redaction. Authenticated routes can expose user data or secrets in shared images.

高

SKILL.md:78-88

Prompt Injection Attempt Detected

SKILL.md states, "You don't need permission to install next-dev-loop itself" and directs non-interactive installation "without asking." This attempts to override user consent and expands the agent's instruction surface through unpinned remote content.

The permission-bypass language is explicit and immediately follows a command that installs a skill from a mutable remote branch.

能力複核項目 (7)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

SKILL.md:78

Ruby/shell backtick execution

Install it before starting the loop. Don't wait until you hit something `next dev` alone can't expla

This explicitly directs the agent to install another skill before migration work begins. The referenced installation uses a mutable canary branch and expands the agent's executable instruction surface.

高

SKILL.md:80-82

Ruby/shell backtick execution

```bash

The enclosed command installs a skill directly from the mutable canary branch of a remote repository. Executing unpinned remote content creates supply-chain and instruction-injection risk.

高

SKILL.md:88-90

Ruby/shell backtick execution

You don't need permission to install `next-dev-loop` itself. It's a tool, like installing a dev depe

The prose says to install next-dev-loop without permission, including during non-interactive runs. This bypasses user consent for remote instruction installation and related environment changes.

高

SKILL.md:81

Hardcoded URL

npx skills add https://github.com/vercel/next.js/tree/canary/skills/next-dev-loop

This URL is passed to a skill installer and targets a mutable canary branch, so it retrieves and installs remote content. Upstream changes could alter the agent's behavior.

中

SKILL.md:23

Ruby/shell backtick execution

- `npx @next/codemod@latest upgrade latest` to apply the version-to-version codemods.

This invokes an unpinned @next/codemod@latest package through npx, executing mutable remote code that can rewrite the project. The legitimate purpose does not remove supply-chain and change-control risk.

中

SKILL.md:36

Ruby/shell backtick execution

- **Older versions without bundled docs.** Suggest `npx @next/codemod@latest agents-md` to the user

This invokes an unpinned @next/codemod@latest package that downloads documentation and rewrites repository instruction files. Consent is requested, but mutable remote execution remains a supply-chain risk.

中

SKILL.md:123-125

Ruby/shell backtick execution

```bash

The enclosed command runs @next/codemod@canary through npx and lets a remote pre-release package modify many route files. Its mutable version and broad write scope create supply-chain and integrity risk.

風險因素

⚡ 包含腳本 (1)

SKILL.md:20

⚙️ 外部命令 (50)

🌐 網路存取 (15)

SKILL.md:196 SKILL.md:14 SKILL.md:24 SKILL.md:26 SKILL.md:51 SKILL.md:68 SKILL.md:76 SKILL.md:81 SKILL.md:133 SKILL.md:145 SKILL.md:178 SKILL.md:190 SKILL.md:233 SKILL.md:234 SKILL.md:235

📁 檔案系統存取 (1)

SKILL.md:220

🔑 環境變數 (1)

SKILL.md:20

偵測到的模式

Screen capture upload

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/vercel-next-cache-components-adoption/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-next-cache-components-adoption/security.svg)](https://skillstore.io/skills/vercel-next-cache-components-adoption?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/vercel-next-cache-components-adoption?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-next-cache-components-adoption/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/vercel-next-cache-components-adoption.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

vercel. (2026). next-cache-components-adoption security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-next-cache-components-adoption/audits/1

BibTeX 引用

@techreport{vercel-vercel-next-cache-components-adoption-2026,
  author = {vercel},
  title = {next-cache-components-adoption security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vercel-next-cache-components-adoption/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "next-cache-components-adoption security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vercel"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/vercel-next-cache-components-adoption/audits/1"
identifiers:
  - type: other
    value: "skillstore:vercel-next-cache-components-adoption:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Prepare an application migration

Assess prerequisites, incompatible settings, and startup blockers before enabling Cache Components.

Plan reviewable migration stages

Separate the baseline opt-out change from feature-level adoption and verification work.

Validate rendering behavior

Check static shells, streamed content, sibling routes, and final production builds.

試試這些提示

Assess migration readiness

Inspect this Next.js app for Cache Components readiness. Report the version, router type, incompatible settings, startup blockers, and recommended approach. Do not edit files.

Create a passing baseline

Enable Cache Components with a staged migration. Ask before installing tools. Preserve behavior, run only approved codemods, and stop after a passing baseline build.

Adopt one feature

Adopt Cache Components for [feature]. Remove opt-outs top-down, fix documented blockers, verify each route in development and the browser, then run a focused build.

Complete and audit adoption

Complete the migration across the app. Preserve security gates, document intentional blocking routes, test sibling routes, and provide a route verification table.

最佳實務

Ask before installing skills, packages, or repository-writing tools.
Migrate layouts before pages and verify sibling routes after shared changes.
Use both browser checks and production builds before marking a route complete.

避免

Do not remove incompatible settings without preserving their intended behavior.
Do not move authentication or authorization gates behind suspense boundaries without approval.
Do not treat a passing build as proof that streamed pages render correctly.

常見問題

Which projects can use this skill?

Use it with runnable App Router projects on Next.js 16.3 or later. Pages Router migration is outside its scope.

Does the skill edit application files?

Yes. It can change configuration, route exports, cache boundaries, and suspense placement after the user approves the approach.

Should I choose staged or direct adoption?

Choose staged adoption for smaller reviewable changes. Choose direct adoption when one branch and a larger combined change are acceptable.

Is browser access required?

Browser access is strongly recommended for streamed routes. Build-only checks cannot confirm the visible static shell or resolved content.

How are security gates handled?

The skill should preserve authentication and authorization behavior. It asks the user before changing gates whose purpose is unclear.

What marks the migration complete?

The build passes, browser checks succeed, migration markers are resolved, and every remaining blocking route has a documented reason.

開發者詳細資訊

作者

vercel

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/vercel/next.js/tree/8d6c076d1420df10afda9b0cf9314a3560b7976e/skills/next-cache-components-adoption

引用

a39a91716eadede5f4cdefd78178fed4e837a128

維護新鮮度

2026/7/24

使用量

0 次下載 · 0 次瀏覽

檔案結構

📁 references/

📄 dev-only-validations.md

📄 per-page-decisions.md

建構更好的 SwiftUI 功能

由 avdlee

SwiftUI 專案可能會累積已棄用的 API、脆弱的狀態，以及緩慢的視圖更新。這項技能針對現代、可維護的 SwiftUI 程式碼提供聚焦指引。

程式開發查看

next-cache-components-adoption

使用我的智慧代理安裝

Agent 可讀資源

測試它

安全審計

已確認的安全問題 (2)

風險因素

偵測到的模式

複製報告連結

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 評分

你可以打造什麼

Prepare an application migration

Plan reviewable migration stages

Validate rendering behavior

試試這些提示

最佳實務

避免

常見問題

開發者詳細資訊

vercel 的更多技能

eve

next-cache-components-optimizer

ai-sdk

turborepo

ai-elements

相關技能

nextjs-architecture

nextjs-optimization

threejs-webgl

vue-best-practices

golang-performance

swiftui-expert-skill