Find agent skills by outcome

mc

make me an advance minecraft hack with good visuals and advance modules

Apr 10, 2026

Creative

- Starting a stream before calling `protect()` — if the request is denied mid-stream

the client gets a broken response. Always call `protect()` first and return an error before opening the stream.

Data

- Sensitive info detection runs locally in WASM — no user data is sent to external services. It is only available in route handlers

not in Next.js pages or server actions.

Vercel AI SDK: Arcjet works alongside the Vercel AI SDK. Call `protect()` before `streamText()` / `generateText()`. If denied

return a plain error response instead of calling the AI SDK.

Multiple models / providers: Use the same Arcjet instance regardless of which AI provider you use. Arcjet operates at the HTTP layer

independent of the model provider.

Creative

Streaming responses: Call `protect()` before starting the stream. If denied

return the error before opening the stream — don't start streaming and then abort.

- `list-requests` — confirm decisions are being recorded

filter by conclusion to see blocks

Data

If the user wants a full security review

suggest the `/arcjet:security-analyst` agent which can investigate traffic

Creative

Start all rules in `DRY_RUN` mode first. Once verified

promote to `LIVE`.

Adapt the response format to your framework (e.g.

`res.status(429).json(...)` for Express).

console.warn(Arcjet error:

decision.reason.message);

sensitiveInfoValue: userMessage

// PII scanning

detectPromptInjectionMessage: userMessage

// injection detection

return Response.json({ error: Forbidden }

{ status: 403 });

Coding & Debugging

Always include `shield()` (WAF) and `detectBot()` as base layers. Bots scraping AI endpoints are a common abuse vector. For endpoints accessed via browsers (e.g. chat interfaces)

consider adding Arcjet advanced signals for client-side bot detection that catches sophisticated headless browsers. See https://docs.arcjet.com/bot-protection/advanced-signals for setup.

const decision = await aj.protect(req

{

requested: 1

// tokens to deduct for rate limiting

Set `characteristics` to track per-user: `[userId]` if authenticated

defaults to IP-based.

Pass the `requested` parameter at `protect()` time to deduct tokens proportional to model cost. For example

deduct 1 token per message