nestjs-crud-v1
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill provides technical documentation for the legacy @nestjs-crud library, focusing on maintenance and integration.
- [SAFE]: The documentation includes important security advisories, such as identifying a silent auth-filter bypass vulnerability in v1 caused by property name typos in the @CrudAuth decorator.
- [SAFE]: It promotes security best practices, including explicit field exclusion for sensitive data (e.g., passwords), the use of server-side maxLimit to prevent resource exhaustion, and proper guard ordering to ensure authentication context is available for authorization filters.
- [COMMAND_EXECUTION]: The instructions include standard npm install commands for library installation and peer dependency management targeting official public registries.
- [INDIRECT_PROMPT_INJECTION]: The skill documents an interface that ingests untrusted user data via HTTP query parameters.
- Ingestion points: HTTP request parameters (filter, sort, join) parsed in SKILL.md.
- Boundary markers: Use of @ParsedRequest() to structure and delimit incoming data.
- Capability inventory: Database CRUD operations via TypeOrmCrudService, DrizzleCrudService, and MikroOrmCrudService.
- Sanitization: Integration with class-validator and CrudValidationGroups for request body validation and schema enforcement.
Audit Metadata