ia-nodejs-backend
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling untrusted data from HTTP requests and external API responses, creating a potential attack surface for indirect prompt injection.
- Ingestion points: REST API endpoints (body, params, query strings) and external service responses are identified as data entry points in SKILL.md and api-design.md.
- Boundary markers: The instructions explicitly require implementing Zod or TypeBox validation at all request boundaries to mitigate untrusted input risks.
- Capability inventory: The skill outlines capabilities for database access (Drizzle/Prisma), file system operations (fs.promises), and outbound networking (opossum circuit breaker).
- Sanitization: The guidance mandates input parsing with Zod, the use of security headers (Helmet), and strict response schemas to prevent data leakage and injection attacks.
Audit Metadata