skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

framework-nextjs

Audit Next.js applications for SSR data leaks, API misconfigurations, and SSRF vectors.

Updated Jul 30, 2026
Search Tags:#security#audit#middleware#nextjs#pentest#ssrf
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill framework-nextjs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: framework-nextjs
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/framework-nextjs
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill framework-nextjs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of auditing modern Next.js applications by automating the detection of common misconfigurations, SSR data leaks, and server-side request forgery vectors.

Core Features & Use Cases

  • Surface Review: Automatically identifies build-manifest exposure, source-map leaks, and API route authentication gaps.
  • SSR & Middleware Analysis: Validates getServerSideProps data handling and tests middleware bypass vectors.
  • Use Case: During a security assessment, use this skill to quickly verify if an application is inadvertently exposing internal route structures or environment variables through client-side build artifacts.

Quick Start

Use the framework-nextjs skill to perform a comprehensive security review of the target application at the provided URL.

Frequently Asked Questions about framework-nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Next.js app for SSR data leaks and API route misconfigurations?▼

To audit a Next.js app for SSR data leaks, automate a security configuration review to identify getServerSideProps data handling issues, build-manifest exposure, and API route authentication gaps.

What is the best way to test Next.js middleware bypass vectors during a pentest?▼

Testing Next.js middleware bypass vectors requires validating middleware logic against strict read-only probe policies to detect routing misconfigurations and potential server-side request forgery vectors safely.

How does build-manifest exposure affect Next.js security posture?▼

Build-manifest exposure affects Next.js security by inadvertently revealing internal route structures and environment variables through client-side build artifacts, allowing automated surface review to detect these leaks.

Can I detect SSRF vectors in Next.js applications using automated tools?▼

You can detect SSRF vectors in Next.js applications by running an automated security posture review that applies scope-gated validation workflows to identify server-side request forgery attack surfaces.

What are the limitations of automated Next.js security auditing?▼

Automated Next.js security auditing is limited by strict read-only probe policies and requires authorized penetration testing scope-gated validation workflows to prevent unintended system modifications during surface review.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

vuln-file-upload

Test server-side file upload filters against extension, MIME-type, and magic-byte bypasses.

Community
Advanced
pwittchenpwittchen
4

audit-security

Identify security vulnerabilities in multi-language codebases and produce structured audit reports.

Community
Advanced
ricardoo022ricardoo022

scan-fase-3

Test Supabase Row Level Security across REST and GraphQL channels.

Community
Advanced
tiandiyiqitiandiyiqi

senior-security

Perform security audits and penetration testing with Python scripts.

Community
Advanced