Skills react-server-components-framework

📦

react-server-components-framework

Name: react-server-components-framework
Author: AI Agent Hub

v1.0.0 Content revision r2 High Risk ⚙️ External commands⚡ Contains scripts🌐 Network access🔑 Env variables

Build React Server Components with Next.js

Server and client boundaries are difficult to design correctly in modern React applications. This skill provides Next.js patterns, templates, examples, and migration guidance.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "react-server-components-framework" from https://skillstore.io/skills/ariegoldkin-react-server-components-framework.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-react-server-components-framework/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/ariegoldkin-react-server-components-framework.md Signed manifest GET /api/skills/ariegoldkin-react-server-components-framework/manifest Signed lockfile GET /api/skills/ariegoldkin-react-server-components-framework/lockfile

Test it

Using "react-server-components-framework". Review a dashboard that fetches all data in one client-side effect.

Expected outcome:

Move independent queries into Server Components near their views.
Start independent requests together to avoid a sequential waterfall.
Keep filters and interactive controls in small Client Components.
Add separate Suspense boundaries for slow dashboard sections.

Using "react-server-components-framework". Plan migration of a product page from getServerSideProps.

Expected outcome:

Create an async App Router page that reads the product on the server.
Define cache behavior from the product freshness requirement.
Move metadata generation into the route metadata function.
Retain interactive selectors as focused Client Components.

Using "react-server-components-framework". Review Server Actions for a resource editor.

Expected outcome:

Require authentication at the start of every mutation.
Check resource ownership inside the database mutation scope.
Validate an explicit field allowlist before updating records.
Revalidate only affected paths or tags after success.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

All 127 static alerts are false positives caused by documentation formatting, standard React patterns, placeholder fetch calls, or server-only environment access. Manual review found stored cross-site scripting, missing authorization, mass assignment, and draft disclosure in the supplied examples. These examples require security hardening before publication.

Files scanned

2,709

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

examples/blog-app-example.tsx:69-89 examples/blog-app-example.tsx:276-279

Stored Cross-Site Scripting in Blog Example

The blog example stores author-supplied post content and renders it as raw HTML without sanitization. Script-bearing content could execute in readers' browsers.

The input schema accepts unrestricted content, stores it, and later passes it directly to dangerouslySetInnerHTML. No sanitization step appears in the example.

High

templates/server-action-template.ts:30-50 templates/server-action-template.ts:110-142 templates/server-action-template.ts:151-158 templates/server-action-template.ts:174-205 templates/server-action-template.ts:219-236

Missing Authorization in Mutating Server Actions

Several exported Server Actions create, delete, toggle, bulk-update, upload, or revalidate without authentication or authorization. Remote callers could abuse these mutation endpoints.

These functions are exported from a use-server module and perform privileged operations without calling the session or ownership checks shown in updateResource.

High

templates/server-action-template.ts:71-92 templates/server-action-template.ts:151-158

Mass Assignment in Resource Update Actions

Update actions accept Partial<Resource> and pass it directly to database operations without an allowlist schema. Callers could modify fields outside the intended form.

The exported actions accept caller-provided partial database records and use them as update data. No Zod schema or field allowlist constrains these values.

Medium

examples/blog-app-example.tsx:238-250

Unpublished Blog Posts Exposed by Slug

The public post page loads any post matching a slug without requiring published status. Anyone who learns a draft slug could read unpublished content.

The listing and static-parameter queries filter published posts, but the page query uses only the slug and renders the returned record without an access check.

Risk Factors

⚙️ External commands (50)

examples/blog-app-example.tsx:93 examples/blog-app-example.tsx:118 examples/blog-app-example.tsx:226 examples/blog-app-example.tsx:424 references/component-patterns.md:61-62 references/component-patterns.md:62-67 references/component-patterns.md:417-422 references/server-actions.md:22-24 SKILL.md:45 SKILL.md:50 SKILL.md:51 SKILL.md:53 SKILL.md:56 SKILL.md:58 SKILL.md:68-80 SKILL.md:80-83 SKILL.md:83-87 SKILL.md:87-89 SKILL.md:89 SKILL.md:98-107 SKILL.md:107-109 SKILL.md:109-113 SKILL.md:113-124 SKILL.md:124-140 SKILL.md:140-147 SKILL.md:147-152 SKILL.md:152-157 SKILL.md:157-160 SKILL.md:160-164 SKILL.md:164-167 SKILL.md:167-171 SKILL.md:171-173 SKILL.md:173-186 SKILL.md:186-201 SKILL.md:201-212 SKILL.md:212-220 SKILL.md:220-244 SKILL.md:244-245 SKILL.md:245-246 SKILL.md:246-254 SKILL.md:254-267 SKILL.md:267-283 SKILL.md:283-300 SKILL.md:300-304 SKILL.md:304-317 SKILL.md:317-321 SKILL.md:321-334 SKILL.md:334-340 SKILL.md:340 SKILL.md:343-344

⚡ Contains scripts (1)

references/component-patterns.md:375

🌐 Network access (24)

🔑 Env variables (6)

references/component-patterns.md:59 references/component-patterns.md:59 references/component-patterns.md:59 templates/server-component-template.tsx:30 templates/server-component-template.tsx:30 templates/server-component-template.tsx:30

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/ariegoldkin-react-server-components-framework/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ariegoldkin-react-server-components-framework/security.svg)](https://skillstore.io/skills/ariegoldkin-react-server-components-framework?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/ariegoldkin-react-server-components-framework?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ariegoldkin-react-server-components-framework/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/ariegoldkin-react-server-components-framework.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AI Agent Hub. (2026). react-server-components-framework security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/ariegoldkin-react-server-components-framework/audits/9

BibTeX citation

@techreport{ai-agent-hub-ariegoldkin-react-server-components-framework-2026,
  author = {AI Agent Hub},
  title = {react-server-components-framework security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/ariegoldkin-react-server-components-framework/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "react-server-components-framework security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "AI Agent Hub"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ariegoldkin-react-server-components-framework/audits/9"
identifiers:
  - type: other
    value: "skillstore:ariegoldkin-react-server-components-framework:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design a New App Router Feature

Choose server and client boundaries, data-fetching strategies, caching rules, and Suspense placement for a new feature.

Review Server-First Architecture

Evaluate an application for excessive client JavaScript, data waterfalls, unsafe mutations, and weak route organization.

Plan a Pages Router Migration

Map legacy data methods, layouts, metadata, and API mutations to App Router equivalents in controlled stages.

Try These Prompts

Explain Component Boundaries

Explain which parts of my feature should be Server Components or Client Components. Ask for missing interaction and data requirements.

Design a Server-First Feature

Design an App Router feature for [feature]. Include component boundaries, data fetching, caching, loading, error, and mutation behavior.

Migrate a Pages Router Route

Create a staged migration plan for this Pages Router route. Map data methods, layouts, metadata, API routes, tests, and rollback points.

Audit an RSC Codebase

Audit this Next.js codebase for boundary errors, waterfalls, cache mistakes, unsafe Server Actions, data exposure, and unnecessary client bundles. Prioritize findings by severity.

Best Practices

Use Server Components by default and keep Client Components focused on interaction.
Validate and authorize every Server Action before performing mutations.
Choose caching and Suspense boundaries from explicit freshness and loading requirements.

Avoid

Do not convert entire pages to Client Components for one interactive control.
Do not pass unvalidated client payloads directly into database mutations.
Do not render stored HTML without strict sanitization.

Frequently Asked Questions

Which framework does this skill target?

It primarily targets Next.js 15 App Router projects using React Server Components and Server Actions.

Can it decide Server and Client Component boundaries?

Yes. It uses data access, interactivity, browser APIs, serialization, and bundle impact to guide boundary decisions.

Does it support Pages Router migrations?

Yes. It maps legacy data methods, layouts, metadata, and API routes to App Router patterns.

Does it provide production-ready application code?

It provides adaptable templates and examples. Projects must supply dependencies, domain models, authentication, authorization, sanitization, testing, and deployment configuration.

Does the skill require network access?

The guidance itself is local documentation. Generated applications may use network requests when their data sources require them.

How should Server Actions be secured?

Treat every action as a public endpoint. Authenticate callers, authorize each resource, validate inputs, limit fields, and avoid exposing sensitive results.