nodejs-express-server
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFECREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill acts as an educational resource for building REST APIs with Express.js and follows security best practices like using bcrypt for password hashing and Sequelize ORM to prevent SQL injection.
- [CREDENTIALS_UNSAFE]: The code snippets in the complete example use placeholder credentials such as 'secret' for JWT signing and 'postgres://user:pass@localhost/db' for database connections. These are demonstrative and typical for tutorial content.
- [PROMPT_INJECTION]: The skill enables the agent to process external data which constitutes a surface for indirect prompt injection. 1. Ingestion points: Untrusted data is ingested via req.body, req.query, and req.params in the Express route handlers defined in SKILL.md. 2. Boundary markers: None are implemented in the provided snippets to distinguish between trusted and untrusted inputs. 3. Capability inventory: The skill facilitates the creation and execution of a web server with file writing and database interaction capabilities. 4. Sanitization: Employs standard JSON parsing middleware and Sequelize ORM models to validate and sanitize input data.
Audit Metadata