better-chatbot-patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited better-chatbot-patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Status: Production Ready Last Updated: 2025-10-29 Dependencies: None Latest Versions: [email protected], [email protected], [email protected], [email protected]
This skill extracts reusable patterns from the better-chatbot project for use in custom AI chatbot implementations. Unlike the better-chatbot skill (which teaches project conventions), this skill provides portable templates you can adapt to any project.
Patterns included:
Manual server action auth and validation leads to:
Create lib/action-utils.ts:
import { z } from "zod"
// Type for action result
type ActionResult<T> =
| { success: true; data: T }
| { success: false; error: string }
// Pattern 1: Simple validation (no auth)
export function validatedAction<TSchema extends z.ZodType>(
schema: TSchema,
handler: (
data: z.infer<TSchema>,
formData: FormData
) => Promise<ActionResult<any>>
) {
return async (formData: FormData): Promise<ActionResult<any>> => {
try {
const rawData = Object.fromEntries(formData.entries())
const parsed = schema.safeParse(rawData)
if (!parsed.success) {
return { success: false, error: parsed.error.errors[0].message }
}
return await handler(parsed.data, formData)
} catch (error) {
return { success: false, error: String(error) }
}
}
}
// Pattern 2: With user context (adapt getUser() to your auth system)
export function validatedActionWithUser<TSchema extends z.ZodType>(
schema: TSchema,
handler: (
data: z.infer<TSchema>,
formData: FormData,
user: { id: string; email: string } // Adapt to your User type
) => Promise<ActionResult<any>>
) {
return async (formData: FormData): Promise<ActionResult<any>> => {
try {
// Adapt this to your auth system (Better Auth, Clerk, Auth.js, etc.)
const user = await getUser()
if (!user) {
return { success: false, error: "Unauthorized" }
}
const rawData = Object.fromEntries(formData.entries())
const parsed = schema.safeParse(rawData)
if (!parsed.success) {
return { success: false, error: parsed.error.errors[0].message }
}
return await handler(parsed.data, formData, user)
} catch (error) {
return { success: false, error: String(error) }
}
}
}
// Pattern 3: With permission check (adapt to your roles system)
export function validatedActionWithPermission<TSchema extends z.ZodType>(
schema: TSchema,
permission: "admin" | "user-manage" | string, // Your permission types
handler: (
data: z.infer<TSchema>,
formData: FormData,
user: { id: string; email: string; role: string }
) => Promise<ActionResult<any>>
) {
return async (formData: FormData): Promise<ActionResult<any>> => {
try {
const user = await getUser()
if (!user) {
return { success: false, error: "Unauthorized" }
}
// Adapt this to your permission system
const hasPermission = await checkPermission(user, permission)
if (!hasPermission) {
return { success: false, error: "Forbidden" }
}
const rawData = Object.fromEntries(formData.entries())
const parsed = schema.safeParse(rawData)
if (!parsed.success) {
return { success: false, error: parsed.error.errors[0].message }
}
return await handler(parsed.data, formData, user)
} catch (error) {
return { success: false, error: String(error) }
}
}
}
// Placeholder functions - replace with your auth system
async function getUser() {
// Better Auth: await auth()
// Clerk: const { userId } = auth(); if (!userId) return null; return await currentUser()
// Auth.js: const session = await getServerSession(); return session?.user
throw new Error("Implement getUser() with your auth provider")
}
async function checkPermission(user: any, permission: string) {
// Implement based on your role system
throw new Error("Implement checkPermission() with your role system")
}// app/actions/profile.ts
"use server"
import { validatedActionWithUser } from "@/lib/action-utils"
import { z } from "zod"
import { db } from "@/lib/db"
const updateProfileSchema = z.object({
name: z.string().min(1),
email: z.string().email()
})
export const updateProfile = validatedActionWithUser(
updateProfileSchema,
async (data, formData, user) => {
// user is guaranteed authenticated
// data is validated and typed
await db.update(users).set(data).where(eq(users.id, user.id))
return { success: true, data: { updated: true } }
}
)When to use:
Handling multiple tool types (MCP, Workflow, Default) with different execution patterns leads to:
Create lib/tool-tags.ts:
// Branded type system for runtime type narrowing
export class ToolTag<T extends string> {
private readonly _tag: T
private readonly _branded: unique symbol
private constructor(tag: T) {
this._tag = tag
}
static create<TTag extends string>(tag: TTag) {
return new ToolTag(tag) as ToolTag<TTag>
}
is(tag: string): boolean {
return this._tag === tag
}
get tag(): T {
return this._tag
}
}
// Define your tool types
export type MCPTool = { type: "mcp"; name: string; execute: (...args: any[]) => Promise<any> }
export type WorkflowTool = { type: "workflow"; id: string; nodes: any[] }
export type DefaultTool = { type: "default"; name: string }
// Branded tag system
export const VercelAIMcpToolTag = {
create: (tool: any) => ({ ...tool, _tag: ToolTag.create("mcp") }),
isMaybe: (tool: any): tool is MCPTool & { _tag: ToolTag<"mcp"> } =>
tool?._tag?.is("mcp")
}
export const VercelAIWorkflowToolTag = {
create: (tool: any) => ({ ...tool, _tag: ToolTag.create("workflow") }),
isMaybe: (tool: any): tool is WorkflowTool & { _tag: ToolTag<"workflow"> } =>
tool?._tag?.is("workflow")
}
export const VercelAIDefaultToolTag = {
create: (tool: any) => ({ ...tool, _tag: ToolTag.create("default") }),
isMaybe: (tool: any): tool is DefaultTool & { _tag: ToolTag<"default"> } =>
tool?._tag?.is("default")
}// lib/ai/tool-executor.ts
import {
VercelAIMcpToolTag,
VercelAIWorkflowToolTag,
VercelAIDefaultToolTag
} from "@/lib/tool-tags"
async function executeTool(tool: unknown) {
// Runtime type narrowing with branded tags
if (VercelAIMcpToolTag.isMaybe(tool)) {
console.log("Executing MCP tool:", tool.name)
return await tool.execute()
} else if (VercelAIWorkflowToolTag.isMaybe(tool)) {
console.log("Executing workflow:", tool.id)
return await executeWorkflow(tool.nodes)
} else if (VercelAIDefaultToolTag.isMaybe(tool)) {
console.log("Executing default tool:", tool.name)
return await executeDefault(tool)
}
throw new Error("Unknown tool type")
}
// When creating tools, tag them
const mcpTool = VercelAIMcpToolTag.create({
type: "mcp",
name: "search",
execute: async () => { /* ... */ }
})
const workflowTool = VercelAIWorkflowToolTag.create({
type: "workflow",
id: "workflow-123",
nodes: []
})When to use:
Supporting multiple AI providers (OpenAI, Anthropic, Google, xAI, etc.) requires:
Create lib/ai/providers.ts:
import { createOpenAI } from "@ai-sdk/openai"
import { createAnthropic } from "@ai-sdk/anthropic"
import { createGoogleGenerativeAI } from "@ai-sdk/google"
export type AIProvider = "openai" | "anthropic" | "google" | "xai" | "groq"
export const providers = {
openai: createOpenAI({
apiKey: process.env.OPENAI_API_KEY,
compatibility: "strict"
}),
anthropic: createAnthropic({
apiKey: process.env.ANTHROPIC_API_KEY
}),
google: createGoogleGenerativeAI({
apiKey: process.env.GOOGLE_API_KEY
}),
xai: createOpenAI({
apiKey: process.env.XAI_API_KEY,
baseURL: "https://api.x.ai/v1"
}),
groq: createOpenAI({
apiKey: process.env.GROQ_API_KEY,
baseURL: "https://api.groq.com/openai/v1"
})
}
// Model registry
export const models = {
openai: {
"gpt-5": providers.openai("gpt-5"),
"gpt-5-mini": providers.openai("gpt-5-mini")
},
anthropic: {
"claude-sonnet-4-5": providers.anthropic("claude-sonnet-4-5"),
"claude-haiku-4-5": providers.anthropic("claude-haiku-4-5")
},
google: {
"gemini-2.5-pro": providers.google("gemini-2.5-pro"),
"gemini-2.5-flash": providers.google("gemini-2.5-flash")
}
}
// Helper to get model
export function getModel(provider: AIProvider, modelName: string) {
const providerModels = models[provider]
if (!providerModels || !providerModels[modelName]) {
throw new Error(`Model ${modelName} not found for provider ${provider}`)
}
return providerModels[modelName]
}import { streamText } from "ai"
import { getModel } from "@/lib/ai/providers"
// In your API route
export async function POST(req: Request) {
const { messages, provider, model } = await req.json()
const selectedModel = getModel(provider, model)
const result = await streamText({
model: selectedModel,
messages
})
return result.toDataStreamResponse()
}When to use:
Managing complex nested state (workflows, UI config) without mutations
Create app/store/workflow.ts:
import { create } from "zustand"
type WorkflowNode = {
id: string
status: "pending" | "running" | "complete" | "error"
data: any
}
type WorkflowStore = {
workflow: {
id: string
nodes: WorkflowNode[]
} | null
updateNodeStatus: (nodeId: string, status: WorkflowNode["status"]) => void
updateNodeData: (nodeId: string, data: any) => void
}
export const useWorkflowStore = create<WorkflowStore>((set) => ({
workflow: null,
// Shallow update pattern - no deep mutation
updateNodeStatus: (nodeId, status) =>
set(state => ({
workflow: state.workflow ? {
...state.workflow,
nodes: state.workflow.nodes.map(node =>
node.id === nodeId ? { ...node, status } : node
)
} : null
})),
updateNodeData: (nodeId, data) =>
set(state => ({
workflow: state.workflow ? {
...state.workflow,
nodes: state.workflow.nodes.map(node =>
node.id === nodeId ? { ...node, data: { ...node.data, ...data } } : node
)
} : null
}))
}))When to use:
Validating related fields (password confirmation, date ranges, etc.)
import { z } from "zod"
// Password match validation
const passwordSchema = z.object({
password: z.string().min(8),
confirmPassword: z.string()
}).superRefine((data, ctx) => {
if (data.password !== data.confirmPassword) {
ctx.addIssue({
path: ["confirmPassword"],
code: z.ZodIssueCode.custom,
message: "Passwords must match"
})
}
})
// Date range validation
const dateRangeSchema = z.object({
startDate: z.string().datetime(),
endDate: z.string().datetime()
}).superRefine((data, ctx) => {
if (new Date(data.endDate) < new Date(data.startDate)) {
ctx.addIssue({
path: ["endDate"],
code: z.ZodIssueCode.custom,
message: "End date must be after start date"
})
}
})
// Conditional required fields
const conditionalSchema = z.object({
type: z.enum(["email", "sms"]),
email: z.string().email().optional(),
phone: z.string().optional()
}).superRefine((data, ctx) => {
if (data.type === "email" && !data.email) {
ctx.addIssue({
path: ["email"],
code: z.ZodIssueCode.custom,
message: "Email is required when type is 'email'"
})
}
if (data.type === "sms" && !data.phone) {
ctx.addIssue({
path: ["phone"],
code: z.ZodIssueCode.custom,
message: "Phone is required when type is 'sms'"
})
}
})When to use:
✅ Adapt patterns to your auth system (Better Auth, Clerk, Auth.js, etc.) ✅ Use branded type tags for runtime type checking ✅ Use shallow updates for nested Zustand state ✅ Use Zod superRefine for cross-field validation ✅ Type your tool abstractions properly
❌ Copy code without adapting to your auth/role system ❌ Assume tool type without runtime check ❌ Mutate Zustand state directly ❌ Use separate validators for related fields ❌ Skip type branding for extensible systems
This skill prevents 5 common issues:
Prevention: Use validatedActionWithUser pattern (adapt to your auth)
Prevention: Use branded type tags with .isMaybe() checks
Prevention: Use shallow Zustand update pattern
Prevention: Use Zod superRefine for related fields
Prevention: Use provider registry with unified interface
templates/action-utils.ts - Complete server action validatorstemplates/tool-tags.ts - Complete tool abstraction systemtemplates/providers.ts - Multi-AI provider setuptemplates/workflow-store.ts - Zustand workflow storeCopy to your project and adapt placeholders (getUser(), checkPermission(), etc.)
Required:
Optional (based on patterns used):
These patterns are extracted from better-chatbot:
Token Efficiency: ~65% savings | Errors Prevented: 5 | Production Verified: Yes
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.