Next.js Security Stinger
Designed and built by Legion Code Inc.
Where this skill's files are
Every path below (guides/, references/, scripts/) is relative to the folder that contains this SKILL.md. In Claude Code that folder is ${CLAUDE_SKILL_DIR}. If that text was not replaced with a real path, find the folder yourself (for example with Glob for **/nextjs-security-stinger/SKILL.md) and use it as the skill directory in every command.
Purpose
Run the Next.js-specific part of the security dimension of an /audit-my-code run. It finds the installed next version in every app of the repo and matches it against a normalized table of 61 GitHub Security Advisories (2024 to 2026-09-30, including CVE-2025-29927 and the React2Shell RSC remote code execution CVE-2025-55182), then reviews the places Next.js apps actually break: authorization that lives only in middleware or proxy.ts, Server Actions and Route Handlers that are public endpoints without auth or ownership checks, private data passed to Client Components or baked into static and cached output, NEXT_PUBLIC_ secrets, broad images.remotePatterns, dynamic-host rewrites, CSP and header gaps, and auth-library misuse (Auth.js, Clerk, Supabase SSR). It writes contract-shaped SEC-NEXT-NNN findings, metrics, and notes to the run workspace and never changes the audited repository.
When to use
- The orchestrator routes a
basic,full, ormariotier run withnextjsinintake.json.stacks. - "Security audit this Next.js app", "are my Server Actions safe", "is our middleware auth enough", "is our Next.js version vulnerable", "check us for CVE-2025-29927 or React2Shell".
- A vibe-coded Next.js app (v0, Cursor, Claude Code, Lovable, Bolt) needs a deep framework pass before launch.
When not to use
- Generic OWASP review, non-
nextdependency CVEs, SQL injection in plain helpers, secrets scanning of the whole repo:security-stingerthroughsecurity-wasp-drone(the generic pass runs alongside this one). - React client-side patterns (XSS through
dangerouslySetInnerHTML, unsafe URLs inhref, client storage of tokens): thereact-securitypair. - SvelteKit or non-JavaScript backends:
sveltekit-securityandpolyglot-securitypairs. - Fixing the code. This skill is research-only; remediation planning belongs to the
mariotier's remediation Drone. - Testing a live site from the outside:
web-security-posture-stinger.
Procedure
- Read guides/00-scoping.md and run
scripts/next_audit_scan.pyagainst the repo with output into<workspace>/02-security/raw/. Record versions, router type, deployment target, auth library, and data access pattern innotes-nextjs-security-wasp-drone.md. - Follow guides/01-version-and-advisory-check.md: confirm lockfile versions, settle advisory preconditions, rewrite or drop scanner findings, append them to
findings-nextjs-security-wasp-drone.jsonl. - Follow guides/02-proxy-middleware-and-auth-boundaries.md: build the boundary map, test middleware-only auth, matcher gaps, unverified sessions, and the auth library checks.
- Follow guides/03-server-actions-and-route-handlers.md: read every action and handler for authentication, ownership, input trust, return values, CSRF, CORS, and SSRF.
- Follow guides/04-data-exposure-and-caching.md: secrets and
NEXT_PUBLIC_, props to Client Components,server-only, source maps, taint,use cache,unstable_cache, static and ISR output. - Follow guides/05-config-and-headers.md: images, rewrites and redirects, headers, CSP, build switches,
next/og. - At the end of steps 3 to 6, sweep references/ai-failure-patterns.md and confirm hits through their owning checks.
- Follow guides/06-writing-findings.md: write and validate findings, metrics measures, and notes. Report the counts and the verdict input to the orchestrator.
References map
| Path | Load when |
|---|---|
guides/00-scoping.md to guides/06-writing-findings.md | In order, for every run |
references/REFERENCE.md | Index of all references and the script's inputs, outputs, and limits |
references/advisory-table.md | Any version or advisory question |
references/next-advisories.json | Read by the scanner; edit only when refreshing research |
references/checks-proxy-and-auth-boundaries.md | Guide 02 |
references/checks-server-actions-and-route-handlers.md | Guide 03 |
references/checks-data-exposure-and-caching.md | Guide 04 |
references/checks-config-and-headers.md | Guide 05 |
references/ai-failure-patterns.md | End of guides 02 to 05 |
references/finding-templates.md | Guide 06 |
references/research/distilled-nextjs-security.md | Verifying a claim or settling a dispute |
| Source research archive (not shipped with the plugin) | Source-repository only; the shipped distillation summarizes it, do not require it |
scripts/next_audit_scan.py | Run once in guide 00; rerun after refreshing the advisory table |
Related drones and stingers
- nextjs-security-wasp-drone - The paired agent. The orchestrator dispatches it for every app with the
nextjsstack. audit-my-code-stinger- Owns the run contract this skill writes against (references/audit-contract.md).security-stinger- Generic security pass that runs next to this one; overlapping findings are merged by the brief renderer.react-securitypair - Client component patterns in the same app.web-security-posture-stinger- Passive outside-in checks of a deployed site, if the user wants headers confirmed live.
Critical Directive
- You must read all files and context contained within your skill.
- In the event your core knowledge does not provide sufficient guidance you must make every attempt to search the internet, related knowledge base documentation files, and other available resources to supplement your knowledge prior to proceeding with your task.
- Additional related skills can be found here:
security-stinger(core Wasp Nest, when installed) - Generic security audit pass that runs alongside this one in the security dimension.- web-security-posture-stinger - Passive external posture checks of a deployed site.
Designed and built by Legion Code Inc. Licensed under AGPL-3.0-or-later.
