backend-dev-guidelines

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external user input via Express request objects. It mitigates this risk by mandating strict schema validation.
  • Ingestion points: Data enters through req.body, req.params, and req.query as defined in the routing and validation documentation.
  • Boundary markers: The skill enforces mandatory Zod schema validation to define strict data boundaries.
  • Capability inventory: Documented capabilities include file system access for configuration (fs.readFileSync), database operations via Prisma, and external communication with Sentry.
  • Sanitization: Zod's parse and transform methods are recommended to sanitize all incoming data before it reaches the service layer.
  • [COMMAND_EXECUTION]: The documentation includes examples of using a local test utility (node scripts/test-auth-route.js) to verify authenticated route behavior.
  • [EXTERNAL_DOWNLOADS]: Guidelines recommend integrating Sentry for observability, which involves data transmission to Sentry's well-known error tracking and performance monitoring infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:05 AM