client-server-boundary

What problem does it solve?

This Skill helps you correctly reason about the line where code and data change execution context from a trusted server runtime to an untrusted client runtime, preventing serialization mistakes, secret leakage, and trust/validation vulnerabilities.

Core Features & Use Cases

• Boundary marking & correctness: Clarifies when and why to use 'use client', 'use server', server-only, and client-only so the framework enforces the intended separation.
• Serialization & payload safety: Explains what kinds of values can cross the boundary across JSON, structured clone, RSC payloads, and FormData—along with common failure/leakage modes.
• Trust model for client→server actions: Provides a disciplined checklist for authenticating, authorizing, validating inputs, and avoiding reliance on client-supplied claims.
• Leakage diagnosis: Guides troubleshooting for issues like server-only imports ending up in client bundles, non-serializable props, and closure/function behavior being crossed incorrectly.
• Verification workflow: Offers concrete “verify” criteria to systematically audit boundary behavior after changes.

Quick Start

Use this skill to review how your app marks server versus client code and how data and actions cross the boundary, then ask the AI to point out any serialization or trust-validation risks in your current design.