The Agent Skills Directory

[SAFE]: The skill serves as an educational and procedural framework for building Next.js applications, with a strong emphasis on security posture. It does not contain executable code itself, but rather guides the AI agent in generating secure code.
[CREDENTIALS_UNSAFE]: The guidelines include critical security checks that forbid the use of the NEXT_PUBLIC_ prefix for secrets and mandate the use of server-only fences for modules handling sensitive data (API keys, database connections, signing keys).
[INDIRECT_PROMPT_INJECTION]: The skill correctly identifies that route parameters, search parameters, and form data are untrusted user inputs. It mandates that these inputs MUST be validated or parsed using schemas (such as Zod) before being used in sensitive operations like database queries, filesystem paths, or redirects.
[DATA_EXPOSURE]: Documentation explicitly warns against the 'Read-Only Repository' anti-pattern, where read-only functions are accidentally exposed as public endpoints via "use server". It mandates authentication and ownership-based authorization checks for all data access functions.
[REMOTE_CODE_EXECUTION]: While the skill discusses Server Functions and Route Handlers (which are remote endpoints), it treats them as public attack surfaces and requires them to perform independent security validation (authentication, authorization, and parsing) to prevent unauthorized execution or data access.
[OBFUSCATION]: A thorough review of the markdown content and code snippets revealed no hidden Base64 strings, zero-width characters, homoglyph substitutions, or steganographic patterns.

next-app-development