Agent skill · security · sugarforever
Next.js Security Scan
Comprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and Next.js-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.
Why this skill is useful
Adds executable scripts for dependency auditing and secret scanning that enhance security capabilities for Next.js applications.
What it needs
Requires npm, python, yarn installed locally. About 3k tokens when loaded. Last updated 2026-06-19. 130 stars on the source repository.
What this skill does
Next.js Security Scan Skill This skill enables comprehensive security scanning of Next.js and TypeScript/JavaScript projects based on OWASP guidelines and industry best practices. When to Use This Skill Security audits of Next.js applications Code review for security vulnerabilities Pre-deployment security checks Dependency vulnerability assessment Detecting hardcoded secrets and credentials Scan Types 1. Quick Scan Fast scan focusing on critical vulnerabilities: Hardcoded secrets and API keys Dangerous function usage (dangerouslySetInnerHTML, eval) Missing authentication in Server Actions Known vulnerable dependencies 2. Full Scan Comprehensive security assessment covering: All OWASP Top 10:2025 categories XSS vulnerability patterns Injection vulnerabilities (SQL, NoSQL, Command) Authentication and authorization flaws Security misconfigurations Cryptographic failures Next.js-specific vulnerabilities Dependency audit (CVE check) Environment variable exposure 3. Targeted Scan Focus on specific vulnerability categories: --xss - Cross-site scripting patterns --injection - SQL/NoSQL/Command injection --auth - Authentication/authorization issues --secrets - Hardcoded credentials --deps - Dependency vulnerabilities --nextjs - Next.js specific issues Scan Procedure Step 1: Project Discovery 1. Identify project type (Next.js App Router, Pages Router, or plain React) 2. Locate configuration files (next.config.js, package.json, .env) 3. Map the codebase structure Step 2: Dependency Audit Run the dependency audit script: Or manually: Step 3: Secret Scanning Scan for hardcoded secrets: Important: Environment File Handling By default, real .env files are SKIPPED (.env, .env.local, .env.production, etc.) These files contain actual secrets and should not be in version control Only .env.example and .env.template files are analyzed for documentation quality Use --include-env-files flag only if explicitly requested by user The scanner will: 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sugarforever/nextjs-security-scan