Nextjs secure bff
NestJS API best-practice skill and adapter pack for coding agents.
npx -y skills add xirothedev/skills --skill nextjs-secure-bffAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use for security-sensitive Next.js backend-for-frontend work involving Route Handlers, Proxy, Server Actions, webhooks, callbacks, data access layers, server-only modules, request validation, rate limits, or public API boundaries. Prefer this skill when a Next.js task exposes HTTP endpoints or moves privileged data across server/client boundaries.
SKILL.md
2.8 KB, as published. Nobody here has run it
Next.js Secure BFF
Use this skill when Next.js acts as a public backend boundary, not just a rendering layer. Treat Route Handlers, Proxy, and Server Actions as externally reachable entry points that need normal backend security review.
When to Apply
Use this skill when:
- Writing or reviewing
app/**/route.ts,proxy.ts, webhook handlers, callback URLs, or BFF proxy endpoints - Designing Server Actions that mutate data or depend on authenticated users
- Moving database, secrets, or internal API access into a Next.js app
- Auditing whether data passed to Client Components is minimized and safe
- Debugging leaks through headers, serialized action results, logs, or broad DTOs
Load On Demand
Start with this file. Load detailed files only when the task needs them:
references/_sections.md
references/api-route-boundaries.md
references/security-server-action-authz.md
references/security-dal-dto.md
references/security-env-server-only.md
references/api-webhook-validation.md
references/api-proxy-headers.md
dataset/security/server-action-authz/correct.ts
sources/inventory.json
Each rule file includes:
- Why the pattern matters
- Incorrect and correct examples
- Dataset path with larger TypeScript/TSX examples
- Official source references
Rule Categories by Priority
Resolve conflicts by lower priority number first. At the same priority, prefer Security, API, then Operations.
| Priority | Category | Impact | Prefix |
|---|---|---|---|
| 1 | Security & Authorization | CRITICAL | security- |
| 2 | Public API Boundaries | CRITICAL | api- |
| 3 | Operations & Runtime Controls | HIGH | ops- |
Source Policy
Prefer official Next.js docs for framework semantics. For auth libraries, follow the library's official adapter docs after this skill establishes the Next.js security boundary. Do not copy community webhook, proxy, or Server Action snippets unless they validate inputs, re-authorize the caller, and filter outputs.