Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Nextjs App Router Patterns Skill Security Audit

What the author says it does (original text)

Master Next.js 14+ App Router with Server Components, streaming, parallel routes, and advanced data fetching. Use when building Next.js applications, implementing SSR/SSG, or optimizing React Server Components.

Independent security check

Do not install or run it yet

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

The product API example permits database creation without authentication or authorization and passes through the whole request body

Source references: 1
What we found

The POST handler parses caller-supplied JSON and passes it directly to db.product.create. It shows no authentication, role check, field allowlist, or schema validation.

Why this matters

If used directly in an accessible route, anyone able to call it could create products or supply extra fields affecting controlled properties such as price, ownership, or publication status.

This is a documentation example, not executing code, but the skill presents patterns for building full-stack features. If copied as shown, any caller able to reach the POST endpoint can pass arbitrary JSON directly into product creation. No authentication, create permission, field allowlist, or schema validation is shown, which could permit unauthorized records or writes to sensitive fields. Users can ask the author to add authentication, role authorization, and a strict input schema, or restrict this example from direct production use.

references/details.md:327In the instructionsOpen original file
export async function POST(request: NextRequest) {  const body = await request.json();  const product = await db.product.create({    data: body,  });  return NextResponse.json(product, { status: 201 });}
High risk

The product-update Server Action directly modifies the database using caller-provided ID and data

Source references: 1
What we found

updateProduct sends id and data directly to the database update without showing identity, object-ownership, administrator-permission, or field checks. Marking code “use server” does not itself provide business authorization.

Why this matters

If the exported Action is client-triggerable, an unauthorized user could alter arbitrary products or sensitive attributes, then invalidate caches so the change propagates to pages.

This is an example in the cache-invalidation section, not a deployed implementation. However, if used as a Server Action, the caller-supplied id and full data object go directly into a database update. It shows no authentication, ownership or administrator check, and no restriction on writable fields; “use server” controls execution location, not business authorization. This could enable unauthorized changes to other products or sensitive fields. Users can ask for authorization and a field allowlist and restrict which clients may invoke it.

references/details.md:419In the instructionsOpen original file
// Invalidate via Server Action("use server");import { revalidateTag, revalidatePath } from "next/cache";export async function updateProduct(id: string, data: ProductData) {  await db.product.update({ where: { id }, data });  revalidateTag("products");  revalidatePath("/products");}
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
High risk

The checkout example processes an order after checking only that address and payment are non-empty

Source references: 1
What we found

checkout accepts address and payment strings from a form, performs only a presence check, and calls processOrder. It shows no session, cart ownership, server-side price calculation, payment-token validation, or final confirmation.

Why this matters

If adopted directly, forged or invalid values could cause incorrect orders, incorrect charges, or bypass server-side pricing checks. If payment contains raw payment details, it also expands handling of sensitive payment data.

This is a simplified checkout example, and real payment controls might be abstracted inside processOrder, so insecurity is not certain. Still, the visible code reads two strings from a form and checks only that they are nonempty; it does not show user-session checks, cart ownership, server-side total recalculation, or payment-token validation. If processOrder does not independently enforce them, copying this pattern could allow unauthorized checkout or tampered payment/order data. Users can ask the author to state that these checks must occur in a trusted server flow and that raw payment credentials must not be accepted.

references/details.md:139In the instructionsOpen original file
export async function checkout(formData: FormData) {  const address = formData.get("address") as string;  const payment = formData.get("payment") as string;  // Validate  if (!address || !payment) {    return { error: "Missing required fields" };  }  // Process order  const order = await processOrder({ address, payment });  // Redirect to confirmation  redirect(`/orders/${order.id}/confirmation`);}

Inside this skill

5 instruction sections

This Skill is guidance for Next.js App Router development and explicitly directs the agent to read the detailed examples when the overview is insufficient; the supplied content consists of documentation and code snippets, not an automatic installer or execution script.

View source
SKILL.md:3In the instructionsOpen original file
name: nextjs-app-router-patternsdescription: Master Next.js 14+ App Router with Server Components, streaming, parallel routes, and advanced data fetching. Use when building Next.js applications, implementing SSR/SSG, or optimizing React Server Components.---
SKILL.md:96In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.

The examples demonstrate server-side database writes, order processing, and cache invalidation. These snippets have real effects only if a user or agent copies them into an application and deploys them.

View source
references/details.md:126In the instructionsOpen original file
  try {    await db.cart.upsert({      where: { sessionId_productId: { sessionId, productId } },      update: { quantity: { increment: 1 } },      create: { sessionId, productId, quantity: 1 },    });    revalidateTag("cart");    return { success: true };
references/details.md:148In the instructionsOpen original file
  // Process order  const order = await processOrder({ address, payment });  // Redirect to confirmation  redirect(`/orders/${order.id}/confirmation`);}
references/details.md:423In the instructionsOpen original file
export async function updateProduct(id: string, data: ProductData) {  await db.product.update({ where: { id }, data });  revalidateTag("products");  revalidatePath("/products");}

The data-fetching example sends page filter values as query parameters to an API host selected by the API_URL environment variable.

View source
references/details.md:44In the instructionsOpen original file
// components/products/ProductList.tsx - Server Componentasync function getProducts(filters: ProductFilters) {  const res = await fetch(    `${process.env.API_URL}/products?${new URLSearchParams(filters)}`,    { next: { tags: ['products'] } }  )  if (!res.ok) throw new Error('Failed to fetch products')  return res.json()}
Start here · InstructionsSKILL.md
nextjs-app-router-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:76In the instructionsOpen original file
async function getProducts() {  const res = await fetch('https://api.example.com/products', {    next: { revalidate: 3600 }, // ISR: revalidate every hour
references/details.md:45In the instructionsOpen original file
async function getProducts(filters: ProductFilters) {  const res = await fetch(    `${process.env.API_URL}/products?${new URLSearchParams(filters)}`,
references/details.md:408In the instructionsOpen original file
// No cache (always fresh)fetch(url, { cache: "no-store" });
Read files
SKILL.md:96In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
Read keys or account settings
references/details.md:46In the instructionsOpen original file
  const res = await fetch(    `${process.env.API_URL}/products?${new URLSearchParams(filters)}`,    { next: { tags: ['products'] } }
Lines read
544
File checksum (to compare versions)
c6e020c9f1307f8239cf5f9182d6eb111a2dc13c4a9fb4870d2937efb552ee4c