Comprehensive security and privacy patterns for Next.js applications. Used to design, implement, and audit secure full-stack features including authentication, API routes, input handling, and GDPR compliance.
SkillScore86Maintained
Automatic
◆Security & AppSec pack
Last verified 8/6/2026
What it changes
Passed 19 of 22 test cases with the skill, and 17 of 22 without it.
Without skill77%
With skill86%
Checks it passed that the model alone missed
The deletion route validates request bodies using schema validation such as Zod.
The design explicitly restricts collection to necessary data fields, omitting unnecessary IP or device metadata.
The server route verifies that the authenticated user owns the resource identified by docId before executing the update.
3 fixed16 passed either way2 still failing1 broke
Pass-rate lift
+9 pp
Tokens
+38%
Agent turns
0%
Response time
-15%
Model gemini-3.6-flashMeasured 8/6/2026v119 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
We need to update our Next.js application to handle user privacy requests for European customers. Please provide an implementation plan and sample server routes for exporting user data and handling account deletion requests according to standard privacy regulations.
What was checked, without and with the skill
Checked
Without skill
With skill
The deletion route validates request bodies using schema validation such as Zod.
Missed
Passed
The implementation includes an endpoint for user data export.
Passed
Passed
The implementation includes an endpoint for account deletion.
Passed
Passed
case-02 · gemini-3.6-flash · 8/6/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md198 linessingle file
Next.js Security & Privacy Skill
This skill defines best practices and security patterns for building secure, privacy-compliant, and production-ready Next.js applications.
The goal is to minimize vulnerabilities, protect user data, and ensure compliance with modern security standards (OWASP, GDPR, etc.).
This includes application security, API protection, authentication flows, input validation, data privacy, and cryptographic verification.
When to use this skill
When building or modifying API routes
When implementing authentication or authorization systems
When handling user input or file uploads
When managing secrets or environment variables
When building payment or sensitive features
When processing personal data (especially EU users / GDPR)
When integrating external services or third-party APIs
When performing a security audit or pre-deployment review
When integrating blockchain or wallet-based authentication
How to use this skill
1. Secrets Management
Never hardcode API keys, tokens, or passwords
Always use environment variables (process.env)
Ensure .env files are ignored in git
Store production secrets in infrastructure (Vercel, AWS, Railway)
Validate required env variables at runtime
2. Input Validation
Treat all user input as untrusted
Validate input using schemas (Zod recommended)
Prefer whitelist validation over blacklist
Never rely only on frontend validation
Return generic validation errors (do not leak internals)