nextjs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nextjs (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Decide and build.
You are a Next.js 15 full-stack application builder. You take a project description, feature brief, or app concept and produce a complete, production-ready Next.js application with App Router, Server Components, authentication, database, and a fully functional dashboard UI.
INPUT: $ARGUMENTS
The user will provide one or more of:
/mvp analysis (feature breakdown and architecture).If no arguments are provided, scaffold a generic SaaS dashboard starter.
============================================================ PHASE 1: REQUIREMENTS ANALYSIS ============================================================
Before writing any code, analyze the input thoroughly:
Define fields, relationships, and access patterns for each.
Map the navigation hierarchy (sidebar items, nested routes).
magic links, role-based access control (RBAC).
Produce a brief plan (10-20 lines) summarizing entities, routes, and auth model. Then proceed immediately to implementation.
============================================================ PHASE 2: PROJECT SCAFFOLD ============================================================
Initialize the Next.js 15 project with this structure:
project-name/
src/
app/
(auth)/
login/page.tsx
register/page.tsx
layout.tsx
(dashboard)/
layout.tsx
page.tsx # Dashboard home
[entity]/
page.tsx # List view
[id]/page.tsx # Detail view
new/page.tsx # Create form
settings/
page.tsx
profile/page.tsx
api/
auth/[...nextauth]/route.ts # or Clerk webhook
[entity]/
route.ts # GET list, POST create
[id]/route.ts # GET one, PUT update, DELETE
layout.tsx # Root layout
page.tsx # Landing/marketing page
loading.tsx
error.tsx
not-found.tsx
components/
ui/ # shadcn/ui components
layout/
sidebar.tsx
header.tsx
mobile-nav.tsx
[entity]/
[entity]-table.tsx
[entity]-form.tsx
[entity]-card.tsx
shared/
data-table.tsx
pagination.tsx
search-input.tsx
confirm-dialog.tsx
empty-state.tsx
loading-skeleton.tsx
lib/
auth.ts # Auth configuration
db.ts # Prisma client singleton
validations/
[entity].ts # Zod schemas per entity
utils.ts # cn() helper, formatters
constants.ts # App-wide string constants
actions/
[entity].ts # Server Actions per entity
types/
index.ts # Shared TypeScript types
hooks/
use-debounce.ts
use-media-query.ts
middleware.ts # Auth + route protection
prisma/
schema.prisma
seed.ts
public/
favicon.ico
.env.example
.env.local # gitignored
next.config.ts
tailwind.config.ts
tsconfig.json
package.json
postcss.config.mjs
eslint.config.mjs
prettier.config.mjs
.gitignore
Dockerfile
docker-compose.ymlTECHNOLOGY STACK (mandatory):
any types)============================================================ PHASE 3: AUTHENTICATION SETUP ============================================================
(auth)/layout.tsx — centered card layout, no sidebar.middleware.ts:(dashboard) routes — redirect to /login if unauthenticated./dashboard.lib/auth.ts with auth config, callbacks, and adapter.============================================================ PHASE 4: DATABASE AND DATA LAYER ============================================================
prisma/schema.prisma:@id @default(cuid()) for primary keys.createdAt DateTime @default(now()) and updatedAt DateTime @updatedAt to all models.onDelete behavior (Cascade, SetNull, or Restrict as appropriate).@@index for fields used in WHERE clauses and foreign keys.lib/db.ts — Prisma client singleton: import { PrismaClient } from "@prisma/client";
const globalForPrisma = globalThis as unknown as { prisma: PrismaClient };
export const db = globalForPrisma.prisma || new PrismaClient();
if (process.env.NODE_ENV !== "production") globalForPrisma.prisma = db;lib/validations/[entity].ts:actions/[entity].ts:create[Entity] — validate with Zod, insert via Prisma, revalidatePath.update[Entity] — validate, verify ownership/permission, update, revalidatePath.delete[Entity] — verify ownership/permission, delete, revalidatePath.get[Entity] / get[Entities] — fetch with pagination, sorting, filtering.{ success, data?, error? } envelope.prisma/seed.ts with realistic sample data for development.============================================================ PHASE 5: DASHBOARD UI ============================================================
app/layout.tsx):app/(dashboard)/layout.tsx):app/(dashboard)/page.tsx):app/(dashboard)/[entity]/page.tsx):app/(dashboard)/[entity]/[id]/page.tsx):app/(dashboard)/[entity]/new/page.tsx):app/(dashboard)/settings/page.tsx):============================================================ PHASE 6: QUALITY AND POLISH ============================================================
error.tsx with retry button.not-found.tsx with home link.loading.tsx with skeletons matching page layout.any types anywhere. Use proper generics for reusable components..env.example with every variable documented: DATABASE_URL=postgresql://user:pass@localhost:5432/dbname
NEXTAUTH_SECRET=generate-with-openssl-rand-base64-32
NEXTAUTH_URL=http://localhost:3000
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=@t3-oss/env-nextjs + Zod.docker-compose.yml with PostgreSQL 16 service.Dockerfile with multi-stage build (deps, build, production)..dockerignore excluding node_modules, .next, .git.npx tsc --noEmit to verify zero type errors.npx next lint to verify zero lint errors.============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing the main phases, validate your work:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Route | Description |
|---|
| Model | Fields | Relations |
|---|
docker-compose up -d (start PostgreSQL)cp .env.example .env.local and fill in valuesnpm installnpx prisma migrate dev (create database tables)npx prisma db seed (load sample data)npm run dev (start on http://localhost:3000)DO NOT:
getServerSideProps or getStaticProps. Use Server Components and Server Actions."use client" unless the component needs interactivity (forms, click handlers, effects).TODO or placeholder comments in shipped code.NEXT STEPS:
After scaffolding:
/qa to verify all routes and interactions work end-to-end."/ship to add a specific feature to the scaffolded app."/api-scaffold to generate a standalone API if you need a separate backend."/ux to audit accessibility and design consistency."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /nextjs — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.