nodejs-backend
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a pattern library and architectural guideline for Node.js development. It does not contain executable malicious code or instructions to bypass safety guardrails. The content is focused on established industry security standards and production-readiness.
- [COMMAND_EXECUTION]: The skill provides defensive guidance on safely executing subprocesses to resolve secrets (e.g., using
child_process.spawn). It correctly identifies risks such as child process timeouts and memory exhaustion (maxBuffer) and provides mitigation strategies like explicit signal handling and pipe destruction. - [EXTERNAL_DOWNLOADS]: The documentation includes a detailed section on dependency supply chain security, recommending the use of frozen lockfiles (
npm ci,pnpm install --frozen-lockfile) and advising on gating lifecycle scripts to prevent execution of unauthorized code during package installation. - [PROMPT_INJECTION]: References to 'ignore' or 'disregard' are used strictly within the context of TypeScript development practices (e.g., avoiding the use of
@ts-ignore) and do not attempt to manipulate the agent's behavior or safety constraints.
Audit Metadata