nest-boot-temporary-directory
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructs the agent on the secure usage of vendor-specific libraries (@nest-boot/temporary-directory and @nest-boot/request-context) within the NestJS framework. It follows standard development patterns for request-scoped resource management.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where external input might influence the 'namespace' parameter used for directory creation. It mitigates this by requiring developers to enforce a strict whitelist of 1-64 ASCII alphanumeric characters, hyphens, or underscores, which prevents path traversal or directory manipulation. Evidence: 1. Ingestion points: The 'namespace' parameter in the create() method of TemporaryDirectoryService. 2. Boundary markers: Documentation explicitly advises against using untrusted inputs like filenames, tenant names, or URL paths. 3. Capability inventory: File system directory creation and recursive cleanup operations. 4. Sanitization: Explicit instruction to use a constrained set of safe characters for namespace labels.
Audit Metadata