Skills building-nextjs-apps

📦

building-nextjs-apps

Name: building-nextjs-apps
Author: Asmayaseen

Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build Correct Next.js 16 Applications

Next.js 16 changes can break routes, caching, and request handling. This skill provides focused patterns for building and upgrading App Router applications.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "building-nextjs-apps" from https://skillstore.io/skills/asmayaseen-building-nextjs-apps.md and its manifest at https://skillstore.io/api/skills/asmayaseen-building-nextjs-apps/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-building-nextjs-apps.md Signed manifest GET /api/skills/asmayaseen-building-nextjs-apps/manifest Signed lockfile GET /api/skills/asmayaseen-building-nextjs-apps/lockfile

Test it

Using "building-nextjs-apps". Create a dynamic product page with metadata and a missing-product state.

Expected outcome:

A route plan using an asynchronous product identifier.
Server-side data and metadata responsibilities.
Loading, error, and missing-product behavior.

Using "building-nextjs-apps". Upgrade a dashboard from Next.js 15 to Next.js 16.

Expected outcome:

A migration checklist covering proxy, asynchronous route values, caching, images, and Turbopack.
A list of affected files and verification steps.

Using "building-nextjs-apps". Add a local due-date field that stores UTC.

Expected outcome:

A browser-to-API conversion flow.
UTC storage guidance and local display behavior.
Validation cases for empty, invalid, and daylight-saving values.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, JavaScript template literals, documented fetch calls, configuration access, and benign route parameters. Two unpinned npx command ranges create medium supply-chain risk. Semantic review also found a high-severity example that returns an HttpOnly session token in a response header.

Files scanned

1,309

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

references/nextjs-16-patterns.md:509-512

HttpOnly session token exposed in response header

The proxy example copies the session cookie value into the x-user-token response header. This exposes the HttpOnly token to clients and defeats its confidentiality protection.

The example directly reads the session cookie and sets its value on a NextResponse header. The documented behavior is explicit and reproducible.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:72-79

Ruby/shell backtick execution

```bash

This range instructs users to run npx packages tagged @latest for project setup. The commands are legitimate, but unpinned registry execution creates a supply-chain risk.

Medium

SKILL.md:257-259

Ruby/shell backtick execution

```bash

This range installs and runs next-devtools-mcp@latest through npx. Executing an unpinned third-party package and granting it MCP access creates a supply-chain risk.

Risk Factors

⚙️ External commands (50)

references/datetime-patterns.md:81-83 references/nextjs-16-patterns.md:344-371 references/nextjs-16-patterns.md:425-449 references/nextjs-16-patterns.md:467-482 references/nextjs-16-patterns.md:536-556 references/nextjs-16-patterns.md:556-567 references/nextjs-16-patterns.md:608-615 SKILL.md:20-35 SKILL.md:35-39 SKILL.md:39-51 SKILL.md:51-55 SKILL.md:55-64 SKILL.md:64-72 SKILL.md:72-79 SKILL.md:79-83 SKILL.md:83-98 SKILL.md:98-102 SKILL.md:102-118 SKILL.md:118-122 SKILL.md:122-141 SKILL.md:141-145 SKILL.md:145-159 SKILL.md:159-163 SKILL.md:163-178 SKILL.md:178-186 SKILL.md:186-200 SKILL.md:200-204 SKILL.md:204-223 SKILL.md:223-229 SKILL.md:229-247 SKILL.md:247-257 SKILL.md:257-259 SKILL.md:259-261 SKILL.md:261-263 SKILL.md:263-273 SKILL.md:273-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-282 SKILL.md:282-283 SKILL.md:283-284 SKILL.md:284-285 SKILL.md:285-291 SKILL.md:291-294 SKILL.md:294-298 SKILL.md:298-301 SKILL.md:301-305 SKILL.md:305-308 SKILL.md:308-312 SKILL.md:312-315

🌐 Network access (13)

references/nextjs-16-patterns.md:341 references/nextjs-16-patterns.md:425 references/nextjs-16-patterns.md:466 references/nextjs-16-patterns.md:536 references/nextjs-16-patterns.md:556 references/nextjs-16-patterns.md:313 references/nextjs-16-patterns.md:395 references/nextjs-16-patterns.md:700 references/nextjs-16-patterns.md:704 SKILL.md:189 SKILL.md:209 SKILL.md:189 SKILL.md:319

🔑 Env variables (14)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-building-nextjs-apps/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-building-nextjs-apps/security.svg)](https://skillstore.io/skills/asmayaseen-building-nextjs-apps?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-building-nextjs-apps?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-building-nextjs-apps/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-building-nextjs-apps.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). building-nextjs-apps security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-building-nextjs-apps/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-building-nextjs-apps-2026,
  author = {Asmayaseen},
  title = {building-nextjs-apps security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-building-nextjs-apps/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "building-nextjs-apps security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-building-nextjs-apps/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-building-nextjs-apps:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a Next.js application

Create an App Router structure with current routing, data fetching, and interface patterns.

Upgrade to Next.js 16

Identify breaking changes and update routes, proxy behavior, caching, images, and Turbopack configuration.

Build full-stack application flows

Design server actions, API routes, authenticated backend requests, and timezone-aware forms.

Try These Prompts

Create a basic page

Create a Next.js 16 App Router page for [feature]. Use TypeScript and explain the file location.

Add a dynamic route

Build a Next.js 16 dynamic route for [resource]. Handle asynchronous params, loading, missing data, and metadata.

Upgrade an existing project

Review this Next.js 15 project for version 16 changes. Update routing, proxy, caching, images, and Turbopack while preserving behavior.

Design an authenticated data flow

Design a Next.js 16 authenticated data flow for [workflow]. Include server boundaries, validation, authorization, token protection, error states, and verification steps.

Best Practices

Confirm the installed Next.js version before applying version-specific patterns.
Keep secrets and session tokens on the server, and validate every external input.
Test migrations with type checks, builds, route navigation, and runtime diagnostics.

Avoid

Do not treat params or searchParams as synchronous values in Next.js 16.
Do not expose session tokens through client-visible headers or public environment variables.
Do not execute unpinned registry packages without reviewing the package and requesting confirmation.

Frequently Asked Questions

Does this skill support the Pages Router?

Its primary guidance targets the Next.js 16 App Router. Pages Router projects need separate patterns.

Can it upgrade a Next.js 15 project?

Yes. It covers major version 16 changes, but you must test project-specific dependencies and behavior.

Does it generate a complete application?

It guides application design and implementation. The final scope depends on your requirements and existing repository.

Does it include authentication?

It includes proxy and cookie examples. Production authentication still requires validated sessions, authorization, CSRF protection, and secure token handling.

Can it handle timezones?

Yes. It explains converting datetime-local input to UTC and displaying stored UTC values in local time.

Is Next.js DevTools MCP required?

No. It is optional for documentation, diagnostics, browser testing, and migration assistance.