api-framework-nestjs
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate architectural patterns and code examples for the NestJS framework. It exclusively references standard, well-known libraries and tools (e.g., @nestjs/core, @prisma/client, typeorm, class-validator).
- [SAFE]: The skill mandates strict security best practices, specifically requiring the use of
ValidationPipewithwhitelist: trueandforbidNonWhitelisted: trueto mitigate mass-assignment vulnerabilities and ensure strict input schema compliance. - [SAFE]: Sensitive data management patterns are implemented correctly using the NestJS
ConfigServiceto retrieve environment variables (e.g.,JWT_SECRET,DB_PASSWORD), avoiding hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for applications that ingest untrusted data from external sources through HTTP endpoints.
- Ingestion points: Request bodies (
@Body), route parameters (@Param), and query strings (@Query) defined in controller patterns acrossexamples/core.mdandexamples/auth.md. - Boundary markers: The instructions strictly mandate the use of Data Transfer Objects (DTOs) with
class-validatordecorators and global validation pipes as boundaries between untrusted input and application logic. - Capability inventory: The patterns describe capabilities for database persistence (Prisma/TypeORM), authentication (Passport/JWT), and external service integration (Mailer).
- Sanitization: Input validation and type transformation are explicitly required and enforced through framework-level pipes and class-validator decorators.
Audit Metadata