next.js-security-scan by sugarforever/01coder-agent-skills
npx skills add https://github.com/sugarforever/01coder-agent-skills --skill 'Next.js Security Scan'此技能基于 OWASP 指南和行业最佳实践,为 Next.js 和 TypeScript/JavaScript 项目提供全面的安全扫描。
专注于关键漏洞的快速扫描:
dangerouslySetInnerHTML、eval)全面的安全评估,涵盖:
专注于特定的漏洞类别:
--xss - 跨站脚本模式广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
--injection - SQL/NoSQL/命令注入--auth - 身份验证/授权问题--secrets - 硬编码凭据--deps - 依赖项漏洞--nextjs - Next.js 特定问题next.config.js、package.json、.env*)运行依赖项审计脚本:
./scripts/dependency-audit.sh
或手动运行:
npm audit --json
# 或
yarn audit --json
扫描硬编码的密钥:
python scripts/secret-scanner.py /path/to/project
重要:环境文件处理
.env 文件会被跳过(.env、.env.local、.env.production 等).env.example 和 .env.template 文件以检查文档质量--include-env-files 标志扫描器将:
.env.example 模板以检查:
针对代码库中的每个文件,对照以下模式进行检查:
references/xss-patterns.md - XSS 漏洞references/injection-patterns.md - 注入漏洞references/auth-vulnerabilities.md - 身份验证问题references/nextjs-specific.md - Next.js 漏洞使用以下内容生成安全报告:
assets/report-template.md - 报告结构| 严重性 | 描述 | 所需操作 |
|---|---|---|
| 严重 | 可利用的漏洞,影响严重 | 需要立即修复 |
| 高 | 重大的安全风险 | 部署前修复 |
| 中 | 潜在的安全问题 | 在下一个版本中修复 |
| 低 | 轻微的安全问题 | 考虑修复 |
| 信息 | 安全最佳实践建议 | 可选改进 |
**/*.ts、**/*.tsx、**/*.js、**/*.jsx - 源代码next.config.js、next.config.mjs - Next.js 配置package.json、package-lock.json - 依赖项middleware.ts、middleware.js - 中间件安全.env.example、.env.template - 扫描以进行模板分析.env、.env.local、.env.production - 默认跳过(包含真实密钥)注意: 真实的 .env 文件绝不应提交到版本控制。扫描器分析 .env.example 模板以确保所需变量的文档记录正确。
app/api/**/* - API 路由(App Router)pages/api/**/* - API 路由(Pages Router)**/actions.ts、**/*-actions.ts - Server Actionslib/auth*、utils/auth* - 身份验证代码**/middleware.* - 中间件文件发现的问题应按以下格式报告:
[严重性] 类别:描述
文件:path/to/file.ts:行号
代码:<相关代码片段>
风险:<安全风险说明>
修复:<推荐的修复措施>
此技能可以生成与以下兼容的输出:
根据需要加载额外上下文:
references/owasp-top-10.md - OWASP Top 10:2025 快速参考references/xss-patterns.md - XSS 检测模式references/injection-patterns.md - 注入漏洞模式references/auth-vulnerabilities.md - 身份验证安全模式references/nextjs-specific.md - Next.js 特定漏洞和 CVE每周安装次数
–
代码仓库
GitHub 星标数
75
首次出现
–
This skill enables comprehensive security scanning of Next.js and TypeScript/JavaScript projects based on OWASP guidelines and industry best practices.
Fast scan focusing on critical vulnerabilities:
dangerouslySetInnerHTML, eval)Comprehensive security assessment covering:
Focus on specific vulnerability categories:
--xss - Cross-site scripting patterns--injection - SQL/NoSQL/Command injection--auth - Authentication/authorization issues--secrets - Hardcoded credentials--deps - Dependency vulnerabilities--nextjs - Next.js specific issuesnext.config.js, package.json, .env*)Run the dependency audit script:
./scripts/dependency-audit.sh
Or manually:
npm audit --json
# or
yarn audit --json
Scan for hardcoded secrets:
python scripts/secret-scanner.py /path/to/project
Important: Environment File Handling
.env files are SKIPPED (.env, .env.local, .env.production, etc.).env.example and .env.template files are analyzed for documentation quality--include-env-files flag only if explicitly requested by userThe scanner will:
.env.example templates to check:
For each file in the codebase, check against patterns in:
references/xss-patterns.md - XSS vulnerabilitiesreferences/injection-patterns.md - Injection flawsreferences/auth-vulnerabilities.md - Auth issuesreferences/nextjs-specific.md - Next.js vulnerabilitiesGenerate a security report using:
assets/report-template.md - Report structure| Severity | Description | Action Required |
|---|---|---|
| CRITICAL | Exploitable vulnerability with severe impact | Immediate fix required |
| HIGH | Significant security risk | Fix before deployment |
| MEDIUM | Potential security issue | Fix in next release |
| LOW | Minor security concern | Consider fixing |
| INFO | Security best practice suggestion | Optional improvement |
**/*.ts, **/*.tsx, **/*.js, **/*.jsx - Source codenext.config.js, next.config.mjs - Next.js configurationpackage.json, package-lock.json - Dependenciesmiddleware.ts, middleware.js - Middleware security.env.example, .env.template - SCAN for template analysis.env, .env.local, .env.production - SKIP by default (contain real secrets)Note: Real .env files should never be committed to version control. The scanner analyzes .env.example templates to ensure proper documentation of required variables.
app/api/**/* - API routes (App Router)pages/api/**/* - API routes (Pages Router)**/actions.ts, **/*-actions.ts - Server Actionslib/auth*, utils/auth* - Authentication code**/middleware.* - Middleware filesFindings should be reported as:
[SEVERITY] Category: Description
File: path/to/file.ts:lineNumber
Code: <relevant code snippet>
Risk: <explanation of the security risk>
Fix: <recommended remediation>
This skill can generate output compatible with:
Load additional context as needed:
references/owasp-top-10.md - OWASP Top 10:2025 quick referencereferences/xss-patterns.md - XSS detection patternsreferences/injection-patterns.md - Injection vulnerability patternsreferences/auth-vulnerabilities.md - Authentication security patternsreferences/nextjs-specific.md - Next.js specific vulnerabilities and CVEsWeekly Installs
–
Repository
GitHub Stars
75
First Seen
–
xdrop 文件传输脚本:Bun 环境下安全上传下载工具,支持加密分享
28,800 周安装