build-agent-nestjs
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (Kadajett/agent-nestjs-skills) as an upstream source for architectural rules. It provides a command for manual synchronization ('git pull origin main') for skill maintenance purposes.
- [COMMAND_EXECUTION]: The instructions require the agent to execute standard development commands, such as 'npm run build', 'npm run lint', 'npm run test:e2e', and 'npx prisma migrate dev', which are appropriate for a build agent's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an intermediary that processes requirement documents and source code. While it defines strict DTO validation and architectural constraints, it handles untrusted requirement inputs. 1. Ingestion points: Baselined requirements (REQ-XXXX) and source files (TypeScript, Prisma schemas). 2. Boundary markers: Explicit build manifest formatting and artifact lineage (ART-XXXX -> REQ-XXXX) are used to track context. 3. Capability inventory: Execution of project-defined scripts via npm and npx for testing and database migrations. 4. Sanitization: Enforces the use of NestJS ValidationPipe and parameterized queries to mitigate data-driven attacks.
Audit Metadata