sota-web-frameworks SKILL.md skillB
sota-web-frameworks from martinholovsky/sota-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add martinholovsky/sota-skills/sota-web-frameworks@git:20261024.8dd2b0aPins git:20261024.8dd2b0a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- martinholovsky/sota-skills
- Path
skills/sota-web-frameworks/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261024.8dd2b0a, committed Oct 24, 2026
- First version recorded
- Jul 6, 2026
- Size
- 12,314 bytes
- Repository stars
- 26
- License
- CC-BY-4.0
State-of-the-art engineering rules (2026) for the JavaScript SSR meta-frameworks: React 19 + Next.js (App Router, React Server Components, Server Actions) and Vue 3 + Nuxt 4 (Nitro server routes, composables) — plus the cross-cutting concerns of server rendering: hydration correctness, SSR state serialization, the server/client trust boundary, and framework-specific security and CVEs. Use when building or auditing any React/Next or Vue/Nuxt app — components, RSC/client boundaries, Server…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# SOTA Web Frameworks (2026) ## Purpose This skill encodes the 2026 state of the art for the two dominant JavaScript SSR stacks — **React + Next.js** and **Vue + Nuxt** — and the server-rendering concerns they share. It is deliberately framework-specific: the traps that matter here (the RSC server/client boundary, Server Actions as public endpoints, hydration mismatches, SSR state leaking across requests, `runtimeConfig`/`NEXT_PUBLIC_` secret boundaries) do not exist at the plain-language level. Two modes: - **BUILD** — writing or modifying components, routes, and data-fetching to this standard. - **AUDIT** — reviewing an existing app and reporting findings. Read SKILL.md fully; load `rules/*.md` on demand per the index below. **Verify every version/CVE claim at use time** — this file's facts were primary-sourced 2026-07 but framework security moves weekly (see the 2025-12 React Server Components RCE). ## Scope boundaries (what lives elsewhere) This skill stacks *on top of* the general skills — load them together, don't duplicate: - **[`sota-javascript-typescript`](../sota-javascript-typescript/SKILL.md)** — strict `tsconfig`, type design, promises, …
Read the whole file at its exact version.
How to install
mdr add martinholovsky/sota-skills/sota-web-frameworks@sha256:18426f5c443adbd8The line at the top of this page pins the label git:20261024.8dd2b0a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_kds2dctar3nggd5f)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Jul 6, 2026 and Oct 24, 2026, about one every 28 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261024.8dd2b0a latest | 2026-10-24 | 8dd2b0a | 12,314 B | B | view · diff |
| git:20261012.ae1b29b | 2026-10-12 | ae1b29b | 12,073 B | B | view · diff |
| git:20260926.3b81c65 | 2026-09-26 | 3b81c65 | 10,935 B | B | view · diff |
| git:20260926.1b7230a | 2026-09-26 | 1b7230a | 10,890 B | B | view · diff |
| git:20260706.49f2896 | 2026-07-06 | 49f2896 | 10,905 B | B | view |
Audit of the latest version
- fail: No script tag (matched: <script)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12314 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
martinholovsky/sota-skills · 26 stars · license CC-BY-4.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_kds2dctar3nggd5f GET https://markdownregistry.com/api/v1/resolve?ref=martinholovsky/sota-skills/sota-web-frameworks GET https://markdownregistry.com/api/v1/blob/18426f5c443adbd8de018e60bd277620ceda901b23b91236ce29634ffdbc6554
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.