Server Actions and Auth Guard Order
Enforces secure request handling sequences for server actions.
Install
mkdir -p .claude/skills/server-actions-and-auth-guard-order && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/18545" && unzip -o skill.zip -d .claude/skills/server-actions-and-auth-guard-order && rm skill.zipInstalls to .claude/skills/server-actions-and-auth-guard-order
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Zod validation before data touch, auth guard sequence, authz inside the action, security headers.Key capabilities
- →Verify caller authentication before validation
- →Parse input using Zod schemas
- →Verify caller authorization on resources
- →Implement business logic after all guards pass
- →Return typed success/error shapes
How it works
The skill enforces a specific sequence of security checks: authentication, schema validation, and authorization, before executing any business logic.
Inputs & outputs
When to use Server Actions and Auth Guard Order
- →Secure server action route handlers
- →Implement auth guard sequence
- →Validate Zod schema in actions
About Server Actions and Auth Guard Order
Implements a mandatory security pipeline for backend mutations. It ensures requests are authenticated and authorized before any data validation or logic execution occurs.
Zod validation before data touch, auth guard sequence, authz inside the action, security headers.
When not to use it
- →When authentication is not required for an endpoint
- →When validation should occur before authentication
- →When client-side auth state is trusted for authorization
Limitations
- →Requires explicit implementation of auth, validation, and authz checks in each handler
- →Does not automatically handle all security headers; some must be configured separately
- →Does not prevent leaking raw DB errors if not explicitly handled
How it compares
This approach prioritizes authentication before validation, preventing unauthenticated callers from accessing validation error details or triggering business logic.
Compared to similar skills
Server Actions and Auth Guard Order side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| Server Actions and Auth Guard Order (this skill) | 0 | 2mo | No flags | Intermediate |
| middleware-protection | 1 | 7mo | Review | Intermediate |
| vercel-data-handling | 1 | 1mo | No flags | Intermediate |
| firebase | 20 | 7mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
middleware-protection
dadbodgeoff
Protect routes with Next.js middleware. Check authentication once, protect routes declaratively. Supports public routes, protected routes, and role-based access.
vercel-data-handling
jeremylongshore
Implement Vercel PII handling, data retention, and GDPR/CCPA compliance patterns. Use when handling sensitive data, implementing data redaction, configuring retention policies, or ensuring compliance with privacy regulations for Vercel integrations. Trigger with phrases like "vercel data", "vercel PII", "vercel GDPR", "vercel data retention", "vercel privacy", "vercel CCPA".
firebase
davila7
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
server-action-pattern
JKKN-Institutions
Create or modify a Next.js Server Action for the JKKN institution website following the project's mandatory pattern. This skill should be used when the user asks to "add a server action", "create a mutation", "wire up a form submit", "add create/update/delete logic", "save/update/delete an entity",
skills
xDaijobu
How to work with TLS Watch - a TLS certificate monitoring application
security-review
AugustSnow1127
Security checklist and best practices for the personal blog project