backend-dev-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external user input via Express request objects. It mitigates this risk by mandating strict schema validation.
- Ingestion points: Data enters through
req.body,req.params, andreq.queryas defined in the routing and validation documentation. - Boundary markers: The skill enforces mandatory Zod schema validation to define strict data boundaries.
- Capability inventory: Documented capabilities include file system access for configuration (
fs.readFileSync), database operations via Prisma, and external communication with Sentry. - Sanitization: Zod's
parseandtransformmethods are recommended to sanitize all incoming data before it reaches the service layer. - [COMMAND_EXECUTION]: The documentation includes examples of using a local test utility (
node scripts/test-auth-route.js) to verify authenticated route behavior. - [EXTERNAL_DOWNLOADS]: Guidelines recommend integrating Sentry for observability, which involves data transmission to Sentry's well-known error tracking and performance monitoring infrastructure.
Audit Metadata