📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills nextjs-supabase-auth
📦
nextjs-supabase-auth
Content revision r2 High Risk ⚙️ External commands🔑 Env variables
Build Next.js Authentication with Supabase
Authentication across browser, server, middleware, and callback contexts is easy to configure incorrectly. This skill provides focused Supabase Auth patterns for Next.js App Router.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "nextjs-supabase-auth" from https://skillstore.io/skills/sickn33-nextjs-supabase-auth.md and its manifest at https://skillstore.io/api/skills/sickn33-nextjs-supabase-auth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "nextjs-supabase-auth". Review my dashboard protection, which checks a browser session after the page loads.
Expected outcome:
- Finding: client-only protection can briefly expose protected content.
- Recommendation: verify the user on the server and enforce access in middleware.
- Validation: test direct navigation with expired and missing sessions.
Using "nextjs-supabase-auth". Plan Supabase OAuth for Google in an App Router application.
Expected outcome:
- Create a provider sign-in action with the deployed callback URL.
- Exchange the callback code for a session on the server.
- Validate the return path as a local route before redirecting.
- Test success, denial, expired code, and malformed return-path cases.
Security Audit
High Riskv6 • 8/4/2026 Open versioned report
The command-execution alerts are false positives caused by JavaScript template literals, Markdown fences, and inline Markdown. Public Supabase environment variables are expected, but the OAuth callback contains a high-severity open redirect through its unvalidated next parameter.
1
Files scanned
314
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Unvalidated OAuth Callback Redirect
The callback concatenates the user-controlled next query value with the site origin. Crafted values can produce an external redirect after authentication and support phishing.
The next value comes directly from URL search parameters and reaches NextResponse.redirect without validation. The data flow is explicit in the example.
Risk Factors
⚙️ External commands (7)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-nextjs-supabase-auth?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-nextjs-supabase-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-nextjs-supabase-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-nextjs-supabase-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). nextjs-supabase-auth security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6BibTeX citation
@techreport{sickn33-sickn33-nextjs-supabase-auth-2026,
author = {sickn33},
title = {nextjs-supabase-auth security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nextjs-supabase-auth security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-08-04"
url: "https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-nextjs-supabase-auth:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Add Authentication to a New Application
Create browser and server clients, login actions, callback handling, and protected routes for a new App Router project.
Review an Existing Auth Integration
Identify insecure session checks, missing middleware, incorrect clients, weak redirect handling, and absent error handling.
Standardize Team Auth Patterns
Define consistent Supabase Auth conventions for server components, server actions, middleware, and OAuth callbacks.
Try These Prompts
Create the Supabase Clients
Set up Supabase browser and server clients for my Next.js App Router project. Explain the required public environment variables and cookie handling.
Protect Application Routes
Add Supabase authentication middleware to protect these routes: [ROUTES]. Refresh sessions and redirect unauthenticated users to [LOGIN_PATH].
Implement an OAuth Flow
Implement Supabase OAuth for [PROVIDER] in Next.js. Include a callback route, validated local redirects, error handling, and production URL considerations.
Audit a Production Integration
Audit my Next.js Supabase Auth implementation. Check client boundaries, verified user retrieval, middleware coverage, redirect validation, cookie updates, errors, and cache revalidation.
Best Practices
- Use getUser for security decisions because it verifies the authentication token.
- Keep browser and server Supabase clients separate and update cookies through supported server interfaces.
- Validate callback destinations as local paths before redirecting authenticated users.
Avoid
- Do not trust getSession alone for server-side authorization checks.
- Do not expose Supabase service-role keys through public environment variables.
- Do not concatenate untrusted query values into authentication redirects.
Frequently Asked Questions
Which Next.js architecture does this skill support?
It focuses on the Next.js App Router, including server components, server actions, route handlers, and middleware.
Does the Supabase anonymous key need to remain secret?
No. It is intended for public clients, but row-level security must restrict database access.
Why should authorization checks use getUser?
getUser verifies the token with Supabase and is appropriate for security-sensitive server decisions.
Can this skill configure Google or GitHub OAuth consoles?
It can guide the application flow, but provider console settings and credentials require external configuration.
Does this skill create row-level security policies?
No. Database authorization and row-level security require separate schema design and policy review.
What should be tested before deployment?
Test login, logout, callback failures, expired sessions, cookie refresh, protected routes, and malformed redirect destinations.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nextjs-supabase-authRef
81e05e636292629114b76cbb3922fbe57672fc02
Maintenance freshness
8/5/2026
Usage
10 downloads · 120 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
nextjs-architecture
81Plan Next.js App Router Architecture
by 89jobrien
Next.js teams can struggle to choose routes, components, data loading, and migration steps. This skill gives structured architecture guidance for App Router, Server Components, and performance.
Coding & Development View
📦
nextjs-optimization
80Optimize Next.js Performance
by Atman36
Next.js applications can become slow through large bundles, weak caching, and unoptimized media. This skill guides Claude, Codex, and Claude Code through focused performance improvements for production apps.
Coding & Development View
📦
api-designer
84Design Production-Ready APIs
by AutumnsGrove
Inconsistent API contracts create integration errors and costly migrations. This skill guides REST, GraphQL, OpenAPI, authentication, versioning, validation, and documentation decisions.
Coding & Development View
📦
vercel-react-view-transitions
82Implement React View Transitions
by vercel-labs
React view transitions are easy to misplace, causing silent or noisy animations. This skill guides route, Suspense, list, and shared element animation choices.
Coding & Development View
📦
senior-frontend
81Build Frontend Apps Faster
by davila7
Frontend work often needs consistent React patterns, performance checks, and project scaffolding. This skill gives Claude and compatible agents practical guidance and local helper scripts for modern web application development.
Coding & Development View
📦
vercel-react-best-practices
80Optimize React and Next.js Code
by vercel-labs
React and Next.js applications often lose performance through waterfalls, large bundles, and avoidable re-renders. This skill gives Claude, Codex, and Claude Code concrete review rules for faster frontend work.
Coding & Development View