Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/AratKruglik/claude-sdlcnpx agentmods add skills/aratkruglik/claude-sdlc/server-component-patternsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aratkruglik/claude-sdlc/server-component-patterns)<a href="https://agentmods.dev/skills/aratkruglik/claude-sdlc/server-component-patterns"><img src="https://agentmods.dev/badge/skills/aratkruglik/claude-sdlc/server-component-patterns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aratkruglik/claude-sdlc/server-component-patterns"><img src="https://agentmods.dev/badge/skills/aratkruglik/claude-sdlc/server-component-patterns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00149 | $0.02587 |
| Opus 5.5 | $0.00060 | $0.01035 |
| Sonnet 5.5 | $0.00030 | $0.00517 |
| Haiku 4.5 | $0.00015 | $0.00259 |
Grade A, and why
server-component-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RSC + Server Actions Patterns
The single most important skill for working in App Router. Get the boundary wrong and you'll get build errors, runtime errors, or silent serialization failures.
Mental model
- Server Component (RSC) — rendered on the server. Has access to:
async/await, server-only modules (DB clients, fs, filesystem), env vars (including secrets). Does NOT have:useState,useEffect,useRef, browser APIs (window,document), event handlers. - Client Component — rendered on the client (after initial HTML hydration). Has access to: hooks, browser APIs, event handlers. Does NOT have: server-only modules, secrets, async/await directly in the component body (the function itself isn't async; data flows in via props or hooks).
- Server Actions — async functions marked
"use server". Callable from Client Components but execute on the server. Form-friendly via<form action={action}>.
Default = RSC. A file is RSC unless its first non-import line is "use client".
When to add "use client"
A file MUST be Client when it uses any of:
- React hooks:
useState,useReducer,useEffect,useLayoutEffect,useRef,useContext,useMemo,useCallback, custom hooks that use the above. - Event handlers:
onClick,onChange,onSubmit,onKeyDown, etc. - Browser APIs:
window,document,localStorage,navigator,IntersectionObserver, etc. - Class components (legacy).
A file MAY be Client when:
- It's a leaf in the tree that just needs interactivity. Push the directive AS DEEP as possible.
A file SHOULD be RSC when:
- It just renders data. No state, no effects, no events.
- It needs to fetch from DB or call server-only APIs.
- It uses async/await for data fetching.
Boundary discipline (push deep)
Anti-pattern:
// ❌ Whole page is Client just because the filter is interactive
'use client';
import { useState } from 'react';
import { db } from '@/lib/db'; // BREAKS — server-only
export default function UsersPage() {
const [filter, setFilter] = useState('');
const users = await db.users.findMany(); // BREAKS — async + server only
return <div>...</div>;
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines 4ad3b7a25509
- 1mo ago First seen · 308 lines · 149 tokens per session scan A 07bb5c73302b
server-component-patterns is a skill published in the GitHub repository AratKruglik/claude-sdlc (53 stars, last pushed 3d ago), licensed MIT. It adds 149 tokens to every session and 2,587 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
nextjs-pages-router
Set up tRPC in Next.js Pages Router with createNextApiHandler, createTRPCNext, withTRPC HOC, SSR via ssr option and ssrPrepass, SSG via createServerSideHelpers with getStaticProps, and server-side helpers for getServerSideProps prefetching.
subscriptions
Set up real-time event streams with async generator subscriptions using .subscription(async function() { yield }). SSE via httpSubscriptionLink is recommended over WebSocket. Use tracked(id, data) from @trpc/server for reconnection recovery with lastEventId. WebSocket via wsLink and createWSClient from @trpc/client…
middlewares
Create and compose tRPC middleware with t.procedure.use(), extend context via opts.next({ ctx }), build reusable middleware with .concat() and .unstablepipe(), define base procedures like publicProcedure and authedProcedure. Access raw input with getRawInput(). Logging, timing, OTEL tracing patterns.
non-json-content-types
Handle FormData, file uploads, Blob, Uint8Array, and ReadableStream inputs in tRPC mutations. Use octetInputParser from @trpc/server/http for binary data. Route non-JSON requests with splitLink and isNonJsonSerializable() from @trpc/client. FormData and binary inputs only work with mutations (POST).
server-side-calls
Call tRPC procedures directly from server code using t.createCallerFactory() and router.createCaller(context) for integration testing, internal server logic, and custom API endpoints. Catch TRPCError and extract HTTP status with getHTTPStatusCodeFromError(). Error handling via onError option.
service-oriented-architecture
Break a tRPC backend into multiple services with custom routing links that split on the first path segment (op.path.split('.')) to route to different backend service URLs. Define a faux gateway router that merges service routers for the AppRouter type without running them in the same process. Share procedure and…