---

name: trpc-auditor description: Audit tRPC procedures for security, validation, and architectural consistency. Ensures procedures follow the service-layer pattern and have proper Zod input validation. Use when reviewing server-side routers and procedures. allowed-tools: Read, Grep, Glob

tRPC Procedure Auditor

Standards

Security

• ✅ Use protectedProcedure for all authenticated routes
• ✅ Validate user permissions within the procedure or middleware
• ✅ Ensure sensitive data is not leaked in response objects

Validation

• ✅ Use Zod for strict input validation (input(z.object({ ... })))
• ✅ Provide meaningful error messages for validation failures

Architecture (The "Service Layer" Rule)

• ❌ NO business logic in routers.
• ✅ Routers should only:
  1. Validate input (via Zod)
  2. Check authentication/authorization
  3. Call a service function from server/services/
  4. Return the result
• ✅ All business logic, database queries, and external API calls must live in server/services/.

Error Handling

• ✅ Use TRPCError with appropriate codes (NOT_FOUND, UNAUTHORIZED, etc.)
• ✅ Log errors before throwing them to the client

Review Checklist

1. Service Layer: Is there business logic in this router? If yes, flag it for move to service layer.
2. Validation: Is every input strictly validated with Zod?
3. Auth: Is the correct procedure type (public vs protected) being used?
4. Typing: Are the return types clear and well-defined?

Auto-Invocation Triggers

This Skill should activate when:

• Reviewing files in server/routers/ or files named *-router.ts
• User asks to "audit trpc" or "check server procedures"