audit-nextjs-server-actions

Name: audit-nextjs-server-actions
Availability: InStock
Author: Shan

Audit Next.js Server Actions for authentication, input validation, and CSRF gaps.

1|Updated May 2, 2026

Search Tags:#authorization #security #authentication #nextjs #input-validation #csrf #server-actions

Ready to run

npx skills add https://github.com/Shankulkarni/vibe-audit --skill audit-nextjs-server-actions

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-nextjs-server-actions
Source: https://github.com/Shankulkarni/vibe-audit/tree/main/skills/audit-nextjs-server-actions
Command: npx skills add https://github.com/Shankulkarni/vibe-audit --skill audit-nextjs-server-actions

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Many Next.js applications rely on Server Actions without proper authentication, input validation, or CSRF protection, creating attack surfaces where server endpoints can be called publicly or with insufficient checks.

Core Features & Use Cases

Identifies server actions that run with 'use server' without authentication checks.
Flags unvalidated inputs passed to database or external calls.
Detects data over-fetching from server actions and missing cache invalidation patterns like revalidatePath.
Provides actionable remediation steps and best-practice guidance for securing Next.js Server Actions in App Router.
Use Case: A team auditing a Next.js app that uses server actions across pages to ensure only authenticated users can mutate data.

Quick Start

Review Next.js Server Actions and implement recommended security patterns (auth checks, input validation, error handling) to protect server endpoints.

Frequently Asked Questions about audit-nextjs-server-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure Next.js Server Actions to prevent unauthorized mutations?▼

Secure Next.js Server Actions by adding authentication checks to prevent unauthenticated mutations. Implement input validation and CSRF protection to close attack surfaces where server endpoints are called publicly without sufficient authorization checks.

Why does my Next.js App Router server action accept unvalidated inputs?▼

Next.js App Router server actions accept unvalidated inputs when missing validation patterns are applied before database or external calls. Identify unvalidated inputs passed to database calls and apply input validation to protect server endpoints.

What is the best way to add CSRF protection to Next.js Server Actions?▼

The best way to add CSRF protection to Next.js Server Actions is to audit 'use server' directives for missing authentication and validate inputs. Apply security patterns to detect over-exposure of data and enforce rate limiting.

How do I fix missing cache invalidation patterns like revalidatePath in Next.js?▼

Fix missing cache invalidation patterns like revalidatePath in Next.js by detecting data over-fetching from server actions. Apply actionable remediation steps to ensure proper cache invalidation after mutations in App Router.

Can I use this security audit for Next.js server actions across reads and mutations?▼

Yes, you can use this security audit for Next.js server actions across reads and mutations. It detects unauthenticated mutations, unvalidated inputs, and over-exposure of data in codebases using 'use server' and App Router.

When do I need to audit Next.js Server Actions for authentication gaps?▼

Audit Next.js Server Actions for authentication gaps when applications rely on 'use server' without proper authentication. Identify missing checks, over-exposed data, and insufficient rate limiting to protect server endpoints from public calls.