Scan Next.js app/api route files for security and architectural violations.
npx skills add https://github.com/CleanExpo/Synthex --skill route-auditor
Please help me install this Agent Skill. Skill: route-auditor Source: https://github.com/CleanExpo/Synthex/tree/main/.claude/skills/route-auditor Command: npx skills add https://github.com/CleanExpo/Synthex --skill route-auditor
Many Next.js API route handlers drift from established security and architecture patterns, introducing vulnerabilities like raw JWT verification, missing validation, exposed error messages, duplicate utilities, and missing organization scoping; this Skill finds those issues before they reach production and enforces the SYNTHEX route standard.
Run a full audit on app/api/ to identify auth drift, missing validation, and org-scoping gaps and receive a grouped report with suggested fixes.
High-intent search queries and answers about installing and using this skill.
To audit Next.js API routes, scan app/api/ files to detect raw JWT usage, missing Zod validation, exposed errors, duplicate utilities, and Prisma org-scoping gaps. This process produces structured findings with line numbers, severities, and remediation suggestions.
Yes, you can automatically fix missing Zod validation and JWT compliance issues. The scanner safely auto-applies fixes for a subset of detected issues and generates grouped reports with suggested remediation for centralized JWT utilities and scoping.
Yes, this route auditing tool works with Prisma and Zod. It verifies proper Prisma scoping by user or organization and ensures Zod input validation is correctly implemented within your Next.js app/api/ route files.
The best way to enforce centralized JWT utilities is running a bulk compliance audit across app/api/ directories. This identifies duplicated local JWT utilities and raw jwt.verify calls, providing actionable fixes to standardize authentication patterns.
You should run an API route compliance check when creating, modifying, or reviewing API routes, and during bulk compliance audits. It acts as a senior-reviewer agent pipeline to verify NextRequest types and sanitized error responses before production deployment.
AlteriomEstablish end-to-end type-safe APIs in TypeScript apps using tRPC, Zod, and Next.js.
hamzaPixlAudit API endpoints for naming, response shape, validation, and authentication issues.
spallempatiIntegrate SAST tools into CI/CD to block pull requests with high-severity findings.
RangeyRoverRun static analysis across multiple languages and generate prioritized issue reports.
