The Agent Skills Directory

[SAFE]: The skill correctly identifies that server functions are independent RPC endpoints and requires that authentication and authorization checks be performed inside the .handler() or via middleware, preventing unauthorized access that might bypass UI-level route guards.
[SAFE]: Guidance includes mandatory input validation using Zod or custom validators at the network boundary to prevent malformed data processing.
[SAFE]: The documentation provides explicit security instructions for implementing CSRF protection using createCsrfMiddleware, which is a critical defense for same-origin RPC endpoints.
[SAFE]: The skill addresses potential data leaks in shared caches by instructing users to use Cache-Control: private and Vary: Cookie, Authorization headers for any response containing identity-dependent data.
[SAFE]: Architectural patterns suggested (e.g., using .server.ts suffixes) promote the isolation of sensitive logic, such as database queries and environment secrets, from the client-side bundle.

start-server-functions