Agent skill
Next.js Security
Core security standards for App Router and Server Actions.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/security-hoangnguyen0403-agent-skills-standar-4
Metadata
Additional technical details for this skill
- labels
-
nextjs security rsc csrf zod
- triggers
-
{ "files": [ "app/**/actions.ts", "middleware.ts" ], "keywords": [ "action", "boundary", "sanitize", "auth", "jose" ] }
SKILL.md
Next.js Security
Priority: P0 (CRITICAL)
Structure
app/
├── lib/
│ └── validation.ts # Shared Zod schemas
└── middleware.ts # Auth & Headers
Implementation Guidelines
- Action Safety: Validate all
FormDataor JSON input using Zod. - Data Boundaries: Never pass whole DB objects to Client Components.
- Server-Only: Mark sensitive logic files with
'use server-only'. - CSRF: Modern Next.js manages this, but ensure unique session origins.
- Middleware Guarding: Use
middleware.tsfor global route protection. - Sanitization: Sanitize HTML if bypassing default React escaping.
Anti-Patterns
- Raw Props: No leaking DB fields: Use DTOs for client data.
- Client Secrets: No process.env in client: Mark as
NEXT_PUBLIC_only if safe. - Unvalidated Actions: No raw JSON actions: Always validate schema.
- Logic in Layouts: No auth in shared Layouts: Insecure; use Middleware.
References
- Secure App Router Patterns
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?