Next.js Security Scan — Skillopedia

Next.js Security Scan Skill This skill enables comprehensive security scanning of Next.js and TypeScript/JavaScript projects based on OWASP guidelines and industry best practices. When to Use This Skill - Security audits of Next.js applications - Code review for security vulnerabilities - Pre-deployment security checks - Dependency vulnerability assessment - Detecting hardcoded secrets and credentials Scan Types 1. Quick Scan Fast scan focusing on critical vulnerabilities: - Hardcoded secrets and API keys - Dangerous function usage ( , ) - Missing authentication in Server Actions - Known vuln…

,\n r'.*_DSN

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, r'AWS_.*', r'STRIPE_.*', r'OPENAI_.*', r'ANTHROPIC_.*'\n]\n\n\ndef should_skip_file(filepath: Path, include_env_files: bool = False) -> bool:\n \"\"\"Check if file should be skipped.\"\"\"\n # Skip directories in path\n for part in filepath.parts:\n if part in SKIP_DIRS:\n return True\n\n # Skip specific files\n if filepath.name in SKIP_FILES:\n return True\n\n # Handle .env files specially\n if filepath.name in REAL_ENV_FILES:\n if not include_env_files:\n return True # Skip real .env files by default\n\n # Template files are handled separately, not skipped\n if filepath.name in ENV_TEMPLATE_FILES:\n return True # Skip in main scan, analyzed separately\n\n # Only scan specific extensions\n if filepath.suffix and filepath.suffix not in SCAN_EXTENSIONS:\n return True\n\n return False\n\n\ndef is_sensitive_var(var_name: str) -> bool:\n \"\"\"Check if a variable name matches sensitive patterns.\"\"\"\n var_upper = var_name.upper()\n for pattern in SENSITIVE_VAR_PATTERNS:\n if re.match(pattern, var_upper):\n return True\n return False\n\n\ndef analyze_env_template(filepath: Path) -> Optional[EnvTemplateAnalysis]:\n \"\"\"Analyze an .env.example template file.\"\"\"\n try:\n content = filepath.read_text(encoding='utf-8', errors='ignore')\n lines = content.split('\\n')\n\n variables = []\n missing_descriptions = []\n sensitive_vars = []\n suggestions = []\n\n prev_line_comment = False\n\n for i, line in enumerate(lines):\n stripped = line.strip()\n\n # Track if previous line was a comment (description)\n if stripped.startswith('#'):\n prev_line_comment = True\n continue\n\n # Parse variable assignment\n if '=' in stripped and not stripped.startswith('#'):\n var_name = stripped.split('=')[0].strip()\n var_value = stripped.split('=', 1)[1].strip() if '=' in stripped else ''\n\n if var_name:\n variables.append(var_name)\n\n # Check if sensitive variable\n if is_sensitive_var(var_name):\n sensitive_vars.append(var_name)\n\n # Check if value looks like a real secret (not placeholder)\n if var_value and not any(p in var_value.lower() for p in [\n 'your_', 'xxx', 'placeholder', 'changeme', 'example',\n 'replace', 'todo', 'fill', '\u003c', '>', 'insert'\n ]) and len(var_value) > 10:\n suggestions.append(\n f\"{var_name}: Value looks like a real secret. \"\n f\"Use a placeholder like 'your_{var_name.lower()}_here'\"\n )\n\n # Check for missing description\n if not prev_line_comment and is_sensitive_var(var_name):\n missing_descriptions.append(var_name)\n\n prev_line_comment = False\n\n # Add general suggestions\n if not any('NEXT_PUBLIC_' in v for v in variables):\n suggestions.append(\n \"Consider documenting which variables should be NEXT_PUBLIC_* for client-side access\"\n )\n\n common_vars = {\n 'DATABASE_URL': 'Database connection string',\n 'NEXTAUTH_SECRET': 'NextAuth.js secret for JWT encryption',\n 'NEXTAUTH_URL': 'NextAuth.js base URL',\n }\n for var, desc in common_vars.items():\n if var not in variables:\n suggestions.append(f\"Consider adding {var} ({desc}) if used in your project\")\n\n return EnvTemplateAnalysis(\n file=str(filepath),\n variables=variables,\n missing_descriptions=missing_descriptions,\n sensitive_vars=sensitive_vars,\n suggestions=suggestions[:5] # Limit suggestions\n )\n\n except Exception as e:\n print(f\"{YELLOW}Warning: Could not analyze {filepath}: {e}{NC}\", file=sys.stderr)\n return None\n\n\ndef find_env_templates(root_dir: str) -> List[Path]:\n \"\"\"Find all .env template files in the project.\"\"\"\n root_path = Path(root_dir)\n templates = []\n\n for template_name in ENV_TEMPLATE_FILES:\n for filepath in root_path.rglob(template_name):\n # Skip node_modules etc.\n skip = False\n for part in filepath.parts:\n if part in SKIP_DIRS:\n skip = True\n break\n if not skip:\n templates.append(filepath)\n\n return templates\n\n\ndef scan_file(filepath: Path) -> list[Finding]:\n \"\"\"Scan a single file for secrets.\"\"\"\n findings = []\n\n try:\n content = filepath.read_text(encoding='utf-8', errors='ignore')\n lines = content.split('\\n')\n\n for i, line in enumerate(lines, 1):\n # Skip comments\n stripped = line.strip()\n if stripped.startswith('//') or stripped.startswith('#'):\n # Still check for actual secrets in comments (they shouldn't be there)\n pass\n\n for pattern_info in SECRET_PATTERNS:\n matches = re.finditer(pattern_info['pattern'], line)\n for match in matches:\n # Mask the actual secret in output\n matched_text = match.group()\n if len(matched_text) > 20:\n masked = matched_text[:10] + '...' + matched_text[-5:]\n else:\n masked = matched_text[:5] + '...'\n\n findings.append(Finding(\n severity=pattern_info['severity'],\n category=pattern_info['name'],\n file=str(filepath),\n line=i,\n match=masked,\n description=f\"Potential {pattern_info['name']} detected\"\n ))\n except Exception as e:\n print(f\"{YELLOW}Warning: Could not read {filepath}: {e}{NC}\", file=sys.stderr)\n\n return findings\n\n\ndef scan_directory(root_dir: str, include_env_files: bool = False) -> list[Finding]:\n \"\"\"Recursively scan directory for secrets.\"\"\"\n root_path = Path(root_dir)\n all_findings = []\n files_scanned = 0\n\n for filepath in root_path.rglob('*'):\n if filepath.is_file() and not should_skip_file(filepath, include_env_files):\n files_scanned += 1\n findings = scan_file(filepath)\n all_findings.extend(findings)\n\n print(f\"Scanned {files_scanned} files\", file=sys.stderr)\n return all_findings\n\n\ndef print_env_template_analysis(analyses: List[EnvTemplateAnalysis], output_format: str = 'text'):\n \"\"\"Print environment template analysis.\"\"\"\n if output_format == 'json':\n return # JSON output handled separately\n\n if not analyses:\n print(f\"\\n{YELLOW}No .env.example or .env.template files found.{NC}\")\n print(f\"Consider creating one to document required environment variables.\\n\")\n return\n\n print(f\"\\n{CYAN}========================================{NC}\")\n print(f\"{CYAN} Environment Template Analysis{NC}\")\n print(f\"{CYAN}========================================{NC}\\n\")\n\n for analysis in analyses:\n print(f\"{BLUE}File: {analysis.file}{NC}\")\n print(f\" Total variables: {len(analysis.variables)}\")\n print(f\" Sensitive variables: {len(analysis.sensitive_vars)}\")\n\n if analysis.sensitive_vars:\n print(f\"\\n {YELLOW}Sensitive variables defined:{NC}\")\n for var in analysis.sensitive_vars:\n print(f\" - {var}\")\n\n if analysis.missing_descriptions:\n print(f\"\\n {YELLOW}Missing descriptions (add comment above):{NC}\")\n for var in analysis.missing_descriptions[:5]:\n print(f\" - {var}\")\n\n if analysis.suggestions:\n print(f\"\\n {BLUE}Suggestions:{NC}\")\n for suggestion in analysis.suggestions:\n print(f\" - {suggestion}\")\n\n print()\n\n\ndef print_findings(findings: list[Finding], env_analyses: List[EnvTemplateAnalysis] = None,\n output_format: str = 'text'):\n \"\"\"Print findings in specified format.\"\"\"\n if output_format == 'json':\n output = {\n 'secrets': [\n {\n 'severity': f.severity,\n 'category': f.category,\n 'file': f.file,\n 'line': f.line,\n 'match': f.match,\n 'description': f.description\n }\n for f in findings\n ],\n 'env_templates': [\n {\n 'file': a.file,\n 'variables': a.variables,\n 'sensitive_vars': a.sensitive_vars,\n 'missing_descriptions': a.missing_descriptions,\n 'suggestions': a.suggestions\n }\n for a in (env_analyses or [])\n ]\n }\n print(json.dumps(output, indent=2))\n return\n\n # Text output for secrets\n print(f\"\\n{BLUE}========================================{NC}\")\n print(f\"{BLUE} Secret Scan Results{NC}\")\n print(f\"{BLUE}========================================{NC}\\n\")\n\n if not findings:\n print(f\"{GREEN}No secrets detected in source code!{NC}\")\n else:\n # Group by severity\n critical = [f for f in findings if f.severity == 'CRITICAL']\n high = [f for f in findings if f.severity == 'HIGH']\n medium = [f for f in findings if f.severity == 'MEDIUM']\n\n print(f\"Total findings: {len(findings)}\")\n print(f\" {RED}Critical: {len(critical)}{NC}\")\n print(f\" {YELLOW}High: {len(high)}{NC}\")\n print(f\" Medium: {len(medium)}\\n\")\n\n for finding in sorted(findings, key=lambda x: ('CRITICAL', 'HIGH', 'MEDIUM').index(x.severity) if x.severity in ('CRITICAL', 'HIGH', 'MEDIUM') else 3):\n if finding.severity == 'CRITICAL':\n color = RED\n elif finding.severity == 'HIGH':\n color = YELLOW\n else:\n color = NC\n\n print(f\"{color}[{finding.severity}] {finding.category}{NC}\")\n print(f\" File: {finding.file}:{finding.line}\")\n print(f\" Match: {finding.match}\")\n print()\n\n # Print env template analysis\n if env_analyses is not None:\n print_env_template_analysis(env_analyses, output_format)\n\n\ndef main():\n import argparse\n\n parser = argparse.ArgumentParser(\n description='Scan for hardcoded secrets in Next.js projects',\n epilog='''\nBy default, real .env files are SKIPPED (they contain actual secrets).\nOnly .env.example/.env.template files are analyzed for documentation quality.\nUse --include-env-files to explicitly scan real .env files (not recommended).\n '''\n )\n parser.add_argument('path', nargs='?', default='.', help='Directory to scan (default: current directory)')\n parser.add_argument('--json', action='store_true', help='Output in JSON format')\n parser.add_argument('--exit-code', action='store_true', help='Exit with code 1 if secrets found')\n parser.add_argument('--include-env-files', action='store_true',\n help='Also scan real .env files (not recommended - they should contain secrets)')\n parser.add_argument('--skip-env-analysis', action='store_true',\n help='Skip .env.example template analysis')\n\n args = parser.parse_args()\n\n if not os.path.isdir(args.path):\n print(f\"{RED}Error: {args.path} is not a directory{NC}\", file=sys.stderr)\n sys.exit(1)\n\n print(f\"{BLUE}Scanning {args.path} for secrets...{NC}\", file=sys.stderr)\n\n if not args.include_env_files:\n print(f\"{BLUE}(Skipping real .env files - use --include-env-files to scan them){NC}\\n\", file=sys.stderr)\n\n # Scan for secrets in source code\n findings = scan_directory(args.path, include_env_files=args.include_env_files)\n\n # Analyze env templates\n env_analyses = None\n if not args.skip_env_analysis:\n templates = find_env_templates(args.path)\n env_analyses = []\n for template in templates:\n analysis = analyze_env_template(template)\n if analysis:\n env_analyses.append(analysis)\n\n print_findings(findings, env_analyses, 'json' if args.json else 'text')\n\n if args.exit_code and findings:\n critical_or_high = [f for f in findings if f.severity in ('CRITICAL', 'HIGH')]\n if critical_or_high:\n sys.exit(1)\n\n sys.exit(0)\n\n\nif __name__ == '__main__':\n main()\n","content_type":"text/x-python; charset=utf-8","language":"python","size":18981,"content_sha256":"df407f996feb6dd1336518670a10e83b815ef93bbfec3f864332d8469e8f84cd"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Next.js Security Scan Skill","type":"text"}]},{"type":"paragraph","content":[{"text":"This skill enables comprehensive security scanning of Next.js and TypeScript/JavaScript projects based on OWASP guidelines and industry best practices.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use This Skill","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security audits of Next.js applications","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Code review for security vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Pre-deployment security checks","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dependency vulnerability assessment","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Detecting hardcoded secrets and credentials","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Scan Types","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Quick Scan","type":"text"}]},{"type":"paragraph","content":[{"text":"Fast scan focusing on critical vulnerabilities:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Hardcoded secrets and API keys","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dangerous function usage (","type":"text"},{"text":"dangerouslySetInnerHTML","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"eval","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Missing authentication in Server Actions","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Known vulnerable dependencies","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Full Scan","type":"text"}]},{"type":"paragraph","content":[{"text":"Comprehensive security assessment covering:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"All OWASP Top 10:2025 categories","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"XSS vulnerability patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Injection vulnerabilities (SQL, NoSQL, Command)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Authentication and authorization flaws","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security misconfigurations","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Cryptographic failures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Next.js-specific vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dependency audit (CVE check)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Environment variable exposure","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Targeted Scan","type":"text"}]},{"type":"paragraph","content":[{"text":"Focus on specific vulnerability categories:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--xss","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Cross-site scripting patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--injection","type":"text","marks":[{"type":"code_inline"}]},{"text":" - SQL/NoSQL/Command injection","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--auth","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Authentication/authorization issues","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--secrets","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Hardcoded credentials","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--deps","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Dependency vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--nextjs","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Next.js specific issues","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Scan Procedure","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: Project Discovery","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Identify project type (Next.js App Router, Pages Router, or plain React)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Locate configuration files (","type":"text"},{"text":"next.config.js","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"package.json","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env*","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Map the codebase structure","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Dependency Audit","type":"text"}]},{"type":"paragraph","content":[{"text":"Run the dependency audit script:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"./scripts/dependency-audit.sh","type":"text"}]},{"type":"paragraph","content":[{"text":"Or manually:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"npm audit --json\n# or\nyarn audit --json","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3: Secret Scanning","type":"text"}]},{"type":"paragraph","content":[{"text":"Scan for hardcoded secrets:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python scripts/secret-scanner.py /path/to/project","type":"text"}]},{"type":"paragraph","content":[{"text":"Important: Environment File Handling","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"By default, real ","type":"text"},{"text":".env","type":"text","marks":[{"type":"code_inline"}]},{"text":" files are ","type":"text"},{"text":"SKIPPED","type":"text","marks":[{"type":"strong"}]},{"text":" (","type":"text"},{"text":".env","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env.local","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env.production","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc.)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"These files contain actual secrets and should not be in version control","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Only ","type":"text"},{"text":".env.example","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":".env.template","type":"text","marks":[{"type":"code_inline"}]},{"text":" files are analyzed for documentation quality","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"--include-env-files","type":"text","marks":[{"type":"code_inline"}]},{"text":" flag only if explicitly requested by user","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The scanner will:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Scan source code for hardcoded secrets","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Analyze ","type":"text"},{"text":".env.example","type":"text","marks":[{"type":"code_inline"}]},{"text":" templates to check:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Which sensitive variables are documented","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Whether variables have descriptions (comments)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If placeholder values look like real secrets","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Suggestions for missing common variables","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 4: Pattern Analysis","type":"text"}]},{"type":"paragraph","content":[{"text":"For each file in the codebase, check against patterns in:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/xss-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - XSS vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/injection-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Injection flaws","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/auth-vulnerabilities.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Auth issues","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/nextjs-specific.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Next.js vulnerabilities","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 5: Report Generation","type":"text"}]},{"type":"paragraph","content":[{"text":"Generate a security report using:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"assets/report-template.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Report structure","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Severity Classification","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Severity","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Action Required","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CRITICAL","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Exploitable vulnerability with severe impact","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Immediate fix required","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"HIGH","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Significant security risk","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Fix before deployment","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"MEDIUM","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Potential security issue","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Fix in next release","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"LOW","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Minor security concern","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Consider fixing","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"INFO","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Security best practice suggestion","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Optional improvement","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Key Files to Scan","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Always Check","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"**/*.ts","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"**/*.tsx","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"**/*.js","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"**/*.jsx","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Source code","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"next.config.js","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"next.config.mjs","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Next.js configuration","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"package.json","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"package-lock.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Dependencies","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"middleware.ts","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"middleware.js","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Middleware security","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Environment Files","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":".env.example","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env.template","type":"text","marks":[{"type":"code_inline"}]},{"text":" - ","type":"text"},{"text":"SCAN","type":"text","marks":[{"type":"strong"}]},{"text":" for template analysis","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":".env","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env.local","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".env.production","type":"text","marks":[{"type":"code_inline"}]},{"text":" - ","type":"text"},{"text":"SKIP","type":"text","marks":[{"type":"strong"}]},{"text":" by default (contain real secrets)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Note:","type":"text","marks":[{"type":"strong"}]},{"text":" Real ","type":"text"},{"text":".env","type":"text","marks":[{"type":"code_inline"}]},{"text":" files should never be committed to version control. The scanner analyzes ","type":"text"},{"text":".env.example","type":"text","marks":[{"type":"code_inline"}]},{"text":" templates to ensure proper documentation of required variables.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"High Priority Locations","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"app/api/**/*","type":"text","marks":[{"type":"code_inline"}]},{"text":" - API routes (App Router)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"pages/api/**/*","type":"text","marks":[{"type":"code_inline"}]},{"text":" - API routes (Pages Router)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"**/actions.ts","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"**/*-actions.ts","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Server Actions","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"lib/auth*","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"utils/auth*","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Authentication code","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"**/middleware.*","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Middleware files","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Output Format","type":"text"}]},{"type":"paragraph","content":[{"text":"Findings should be reported as:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"[SEVERITY] Category: Description\n File: path/to/file.ts:lineNumber\n Code: \u003crelevant code snippet>\n Risk: \u003cexplanation of the security risk>\n Fix: \u003crecommended remediation>","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Integration with CI/CD","type":"text"}]},{"type":"paragraph","content":[{"text":"This skill can generate output compatible with:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"GitHub Security Advisories","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SARIF format for GitHub Code Scanning","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"JSON for custom integrations","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"paragraph","content":[{"text":"Load additional context as needed:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/owasp-top-10.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - OWASP Top 10:2025 quick reference","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/xss-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - XSS detection patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/injection-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Injection vulnerability patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/auth-vulnerabilities.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Authentication security patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/nextjs-specific.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Next.js specific vulnerabilities and CVEs","type":"text"}]}]}]}]},"metadata":{"date":"2026-11-02","name":"Next.js Security Scan","author":"@skillopedia","source":{"stars":139,"repo_name":"01coder-agent-skills","origin_url":"https://github.com/sugarforever/01coder-agent-skills/blob/HEAD/skills/nextjs-security-scan/SKILL.md","repo_owner":"sugarforever","body_sha256":"64210918bb035e3434009791bbd8686edfaf5b165be3f9648230357229f45efc","cluster_key":"7915aea4c31b2f551f2df441bcf90553b57cce5608be39c2f322ca463ec1dd4e","clean_bundle":{"format":"clean-skill-bundle-v1","source":"sugarforever/01coder-agent-skills/skills/nextjs-security-scan/SKILL.md","text_bytes":79214,"source_commit":"6f009ba0e3353df03139d477a0a14cd94e785fc9","skills_sh_rank":18357,"attachment_count":9,"text_attachments":9,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/nextjs-security-scan/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"skills-sh-top20k-2026-11","description":"Comprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and Next.js-specific security problems. Audits dependencies for known CVEs and generates actionable security reports."}},"renderedAt":1793666383180}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.