Anything in a NEXT_PUBLIC_ variable is copied into the JavaScript every visitor downloads, so a secret key there is public the moment you deploy. This skill finds that and eight other Next.js configuration mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your next.config (js, mjs, ts), your .env files and your NextAuth or Auth.js config (auth.ts, [...nextauth] routes). It reads JavaScript and TypeScript with comments removed and strings kept, and knows which public keys are meant to be public (Stripe publishable keys, Supabase anon keys, Firebase and Maps keys). It never runs Node or Next.js. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• N01: a secret in a NEXT_PUBLIC_ (or VITE_, REACT_APP_, EXPO_PUBLIC_) variable

• N02: a secret listed under env or publicRuntimeConfig in next.config

• N03: a sample or short NEXTAUTH_SECRET or AUTH_SECRET

REVIEW (check before release)

• N11: productionBrowserSourceMaps on

• N12: TypeScript or ESLint errors ignored in builds

• N13: images.remotePatterns open to every host

• N14: dangerouslyAllowSVG without a CSP

• N15: Server Actions allowedOrigins '*'

• N16: NextAuth debug or allowDangerousEmailAccountLinking on

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (next.config, .env and auth.ts), and the real report the scanner produces on the risky one

Limits

It reads files as written: variables set in your hosting provider, middleware, route handlers and component code are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 12 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (7 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.