nextjs

Detect Next.js App Router anti-patterns in PRs involving Server Actions and caching.

Updated May 15, 2026
One-click install
npx skills add https://github.com/mattnowdev/super-review --skill nextjs-mattnowdev
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: nextjs
Source: https://github.com/mattnowdev/super-review/tree/main/skills/nextjs
Command: npx skills add https://github.com/mattnowdev/super-review --skill nextjs-mattnowdev

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It reduces costly production issues in Next.js apps by identifying high-risk App Router anti-patterns such as cache poisoning, secret leakage across the RSC boundary, and incorrect cache invalidation after mutations.

Core Features & Use Cases

  • Next.js 15/16 anti-pattern coverage: Reviews Server Actions security, cache invalidation behavior, and App Router request APIs (params/searchParams, cookies/headers) for correctness.
  • RSC and client boundary safety: Flags server-to-client prop serialization of secrets and prevents accidental client bundle cascades from misplaced 'use client'.
  • Caching correctness: Detects misuse of 'use cache', unstable_cache keying mistakes, and invalidation gaps (revalidatePath/revalidateTag or updateTag in Next 16 scenarios).

Quick Start

Use the nextjs skill during a PR review to identify and explain likely Next.js App Router anti-patterns in the changed diff with evidence-based guidance.

Frequently Asked Questions about nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Next.js App Router caching and RSC boundary bugs in my pull requests?

Yes, you can review Server Actions for security vulnerabilities by checking for missing auth gates and preventing accidental client bundle cascades from misplaced 'use client' directives during your pull request reviews.

How does cache invalidation work with Server Actions in Next.js 15 and 16?

Cache invalidation with Server Actions requires matching known unsafe constructs and recommending targeted fixes like cacheTag and updateTag pairing, or using revalidatePath and revalidateTag to prevent stale UI after mutations.

Why does my Next.js App Router leak secrets across the RSC boundary?

Your Next.js App Router leaks secrets across the RSC boundary when server-to-client prop serialization accidentally exposes sensitive data, which can be prevented by flagging misplaced 'use client' directives and enforcing minimal secret projections.

Does the nextjs skill work with Next.js 15 and 16 async request APIs?

Yes, the nextjs skill works with Next.js 15 and 16 async request APIs by reviewing params, searchParams, cookies, and headers for correctness and detecting high-impact App Router anti-patterns in the changed diff.

What are common unstable_cache keying mistakes in Next.js and how do I fix them?

Common unstable_cache keying mistakes in Next.js involve incorrect cache behavior and invalidation gaps, which you fix by detecting misuse of 'use cache' directives and ensuring proper cacheTag and updateTag pairing.