Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Nextjs Pro

ASecurity

Idiomatic Next.js: App Router, Server Components, data fetching/caching, and production deployment. Use when writing, reviewing, or structuring Next.js applications.

2 stars
0 votes
0 copies
0 views
Added 9/29/2026
ai-agentstypescriptrustgoshellreactnextjsdebuggingapidatabaseperformance

Works with

cliapi

Security Analysis

A100/100

Scanned 9/29/2026

$npx -y skills add aicodedecode/awesome-muse-skills --skill nextjs-pro --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Nextjs Pro?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Nextjs Pro
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/aicodedecode-nextjs-pro/badge)](https://www.skillsdirectory.com/skills/aicodedecode-nextjs-pro)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
name: nextjs-pro
description: Idiomatic Next.js: App Router, Server Components, data fetching/caching, and production deployment. Use when writing, reviewing, or structuring Next.js applications.
category: development
---

# Next.js Pro

## Overview

Next.js App Router's model — **React Server Components by default, client components as
opt-in, and granular caching** — rewards thinking carefully about where code runs. Professional
Next.js means mastering the server/client boundary, using the caching model deliberately (not
accidentally), colocating data fetching with the components that need it, and treating Server
Actions as the mutation story.

The through-line: server by default, client by necessity, cached by design.

## When to use

- Writing or reviewing Next.js App Router code.
- Designing server/client component boundaries.
- Debugging caching issues (stale data, over-fetching) or hydration errors.
- Structuring routes, layouts, data fetching, and mutations.
- Optimizing Next.js performance and deployment.

## Core concepts

- **Server Components by default.** Async components fetching data directly (`await db.query()`
  in the component) — no useEffect waterfalls, no API round-trip for your own database. Client
  components (`'use client'`) only for interactivity, browser APIs, and hooks — pushed to the
  leaves, not the root.
- **The caching model, deliberate.** `fetch` caching, route segment config (`revalidate`,
  `dynamic`), and `unstable_cache` — understand what caches what, or you'll debug stale data
  forever. Default to static where possible; opt into dynamic explicitly; revalidate with
  `revalidatePath`/`revalidateTag` on mutation.
- **Colocated data fetching.** Fetch next to the component that renders the data; parallelize
  independent fetches (same-tick promises); Suspense boundaries for streaming independent
  sections. Request waterfalls are a design smell — hoist and parallelize.
- **Server Actions for mutations.** `'use server'` functions called directly from client
  components — form submissions, updates — with `revalidatePath` after mutation and
  `useFormStatus`/`useActionState` for pending/error UI. Validate inputs server-side (zod);
  never trust the client.
- **Route groups and layouts.** `(group)` for organization without URL impact; layouts for
  persistent UI; `loading.tsx`/`error.tsx` per segment for granular states; `not-found.tsx`
  for 404s. Parallel/intercepting routes for advanced patterns (modals over pages) — powerful
  but only when the UX demands it.
- **Middleware sparingly.** Auth checks, redirects, A/B headers — middleware runs on every
  matched request (edge runtime limits apply). Don't put business logic there; it's a gate,
  not a service layer.

## Practical workflow

1. **Scaffold:** `create-next-app` with TypeScript, App Router, and your styling choice;
   strict TS; ESLint with Next.js rules in CI.
2. **Draw the server/client boundary.** Page shells and data components → server; interactive
   widgets → client leaves. Props cross the boundary (serializable only — no functions, no class
   instances).
3. **Fetch deliberately.** Server components fetch directly; parallelize with `Promise.all` or
   same-tick awaits; wrap independent sections in `<Suspense>` for streaming; set revalidation
   per data freshness needs.
4. **Mutate with Server Actions.** Validate → mutate → revalidate → redirect/return state;
   optimistic updates via `useOptimistic` where rollback is well-defined.
5. **Handle all states per segment.** `loading.tsx` skeletons, `error.tsx` with reset, and
   `not-found.tsx` — users should never see a blank segment or raw error.
6. **Deploy and observe.** Vercel or self-hosted (standalone output); monitor Core Web Vitals,
   server action errors, and cache hit rates; set up ISR/revalidation monitoring for stale-data
   detection.

Server/client sketch:

```tsx
// app/orders/page.tsx — Server Component: fetches directly
export default async function OrdersPage({ searchParams }) {
  const orders = await getOrders(searchParams.status); // runs on server
  return (
    <>
      <FilterBar /> {/* 'use client' leaf: interactive */}
      <Suspense fallback={<OrdersSkeleton />}>
        <OrderTable orders={orders} />
      </Suspense>
    </>
  );
}
```

## Common pitfalls

- **`'use client'` at the root.** Making the whole page client-rendered "to use hooks" —
  forfeits SSR, streaming, and direct data access. Push the boundary to the leaves.
- **Waterfall fetching.** Sequential awaits for independent data, or client components fetching
  in effects what the server component could fetch directly. Parallelize; colocate.
- **Cache confusion.** Stale data blamed on "Next.js bugs" that's actually default static caching;
  or `revalidate = 0` everywhere "to be safe," forfeiting the performance story. Learn the model;
  set it per route deliberately.
- **Non-serializable props across the boundary.** Passing functions, Dates-as-class-instances, or
  complex objects from server to client components — serialization errors or subtle bugs. Plain
  data only.
- **Hydration mismatches.** `new Date()`, `Math.random()`, or `typeof window` checks rendering
  different HTML on server vs client. Render deterministically; defer client-only bits.
- **Server Actions without validation.** Trusting client-submitted data in actions. Validate
  every input server-side; authorize every mutation (the action runs with server privileges).
- **Middleware bloat.** Business logic, DB queries, and heavy computation in middleware —
  it runs on every request at the edge. Keep it to routing/auth decisions.

Attribution

aicodedecodeaicodedecode
View sourceSee grades on GitHubMore from aicodedecode →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Caveman

Terse caveman voice: answer first, fluff gone, every technical fact kept. Use for /caveman, "caveman mode", "talk like caveman", "be brief", "less tokens". Stays on until "stop caveman" or "normal mode".

1100021 votes

Hyperplan

Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...

698621 votes

Writing Skills

Create and manage Claude Code skills in HASH repository following Anthropic best practices. Use when creating new skills, modifying skill-rules.json, understanding trigger patterns, working with hooks, debugging skill activation, or implementing progressive disclosure. Covers skill structure, YAML frontmatter, trigger types (keywords, intent patterns), UserPromptSubmit hook, and the 500-line rule. Includes validation and debugging with SKILL_DEBUG. Examples include rust-error-stack, cargo-dep...

3931 votes

Mcp Code Execution

Routes multi-tool workflows through MCP servers for large datasets and pipelines. Use when Bash tool overhead is limiting throughput on data-heavy tasks.

3421 votes

catchup

Recovers the conversation and failed tool calls of a previous Codex, Amp, Claude Code, Antigravity, Cline, Copilot CLI, Cursor, DeepSeek Harness, Grok Build, Kimi, OpenCode, Pi Agent, or ZCode session. Use when the user says "catch up", "what did the last session do", "get me up to speed", "I switched agents", asks to recover/summarize a previous session before continuing, or asks to diagnose or report a catchup failure. Do NOT use for the current conversation, git history, or any non-agent log.

741 votes
View all in ai-agents →