Identify authorization, caching, and runtime vulnerabilities in Next.js applications.
npx skills add https://github.com/xalgord/xalgorix --skill nextjs-xalgord
Please help me install this Agent Skill. Skill: nextjs Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/frameworks/nextjs Command: npx skills add https://github.com/xalgord/xalgorix --skill nextjs-xalgord
This playbook provides a structured approach to discovering and validating authorization drift, caching boundary failures, server action misuse, and Edge/Node runtime divergences specific to Next.js applications, reducing missed vulnerabilities that arise from Next.js' multiple routers and rendering modes.
Scan https://target.example for middleware bypasses, server action abuse, RSC/flight-data leakage, and cache boundary vulnerabilities.
High-intent search queries and answers about installing and using this skill.
Server actions and RSC payloads can leak data if not properly secured. Detect server action invocation flaws and RSC flight data leakage by inspecting client bundles and testing invocation endpoints for strict server-side authorization during penetration testing.
Test Next.js middleware bypasses by manipulating HTTP headers, probing parameter pollution, and checking route normalization. Compare access controls between App Router and Pages Router to uncover cross-router authorization inconsistencies in your application.
Yes, the image optimizer can be exploited for SSRF vectors. Test the Next.js image optimizer by manipulating source URL parameters to probe for server-side request forgery vulnerabilities, and check NextAuth callback configurations for authorization issues.
Next.js caching weaknesses include ISR and on-demand revalidation flaws, plus cache key confusion. Probe cached responses for user-specific data leakage by testing revalidation endpoints and manipulating cache keys during security reviews.
zebbernAutomate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.
uphiagoDetect Next.js 13/15 vulnerabilities including Server Actions auth bypass and Image Optimization SSRF.
TimeKastStandardize Next.js 16+ server actions and route handlers with Zod validation and ActionResult contracts.
sugarforeverScan Next.js and TypeScript/JavaScript projects for security vulnerabilities.
