nextjs-developer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, nextjs, performance, react, vercel, web.

What it does

Use when building Next.js 14+ applications with App Router, server components, or server actions. Invoke to configure route handlers, implement middleware, set up API routes, add streaming SSR, write generateMetadata for SEO, scaffold loading.tsx/error.tsx boundaries, or deploy to Vercel. Triggers on: Next.js, Next.js 14, App Router, RSC, use server, Server Components, Server Actions, React Server Components, generateMetadata, loading.tsx, Next.js deployment, Vercel, Next.js performance.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill nextjs-developer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/nextjs-developer ~/.claude/skills/nextjs-developer

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a Next.js implementation/deployment guide, not a codebase with hidden scripts. Its main risks come from the fact that it explicitly drives build/install/deploy workflows, handles production environment variables, and can publish to Vercel.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill tells the agent to run real shell commands such as `npm i -g vercel`, `npm install`, `npm run build`, and `docker-compose up -d`, so it can execute the project’s build/deploy pipeline.
Network access	2 (moderate)	It sends data to external services and hosts, including `vercel --prod`, `SpeedInsights`/`Analytics`, and example fetches like `https://api.example.com/...`, so outbound network use is part of the workflow.
Filesystem reach	1 (low)	The file operations are mostly scoped to the project, such as writing `public/uploads/<file>` and copying `.next/standalone` / `.next/static`; there is no clear broad host-file access.
Secrets & credentials	2 (moderate)	It explicitly relies on secrets and env files like `.env.local`, `DATABASE_URL`, and `NEXTAUTH_SECRET`, and shows server-side access via `process.env.DATABASE_URL`.
Privilege & persistence	2 (moderate)	It includes system-wide or service-level actions like `npm i -g vercel` and `pm2 startup`, which can modify the user’s environment beyond the repo.
Instruction hijack surface	0 (none)	I found no instructions to ignore safeguards, hide behavior, or follow untrusted remote content; the “MUST NOT DO” line is build hygiene, not prompt injection.
Irreversible actions	3 (high)	Production publishing is built in: the skill says it is used to “deploy to Vercel” and shows `vercel --prod`, which can push changes live with broad blast radius.
Transparency	0 (none)	All files are plain markdown and readable; there are no binaries, obfuscated blobs, or runtime-downloaded scripts.

Before installing

Read `references/deployment.md` for the exact deploy path: it includes `npm i -g vercel` and `vercel --prod`.
Check whether you are comfortable exposing `DATABASE_URL`, `NEXTAUTH_SECRET`, and any `NEXT_PUBLIC_*` values to the build/deploy environment.
If you will use the deployment flow, test it in a throwaway project or non-production Vercel project first.
Confirm you want the agent to run build commands on your machine (`npm install`, `npm run build`, Docker/PM2 steps).

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/nextjs-developer/SKILL.md
Branch: main
Updated: 2026-09-19

csharp-developer — Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Builds REST APIs using minimal or controller-based routing.
dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
graphql-architect — Use when designing GraphQL schemas, implementing Apollo Federation, or building real-time subscriptions.
java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
react-expert — Use when building React 18+ applications in .jsx or .tsx files, Next.js App Router projects, or create-react-app setups. Creates components.