backend-dev-guidelines
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill consists of educational documentation and architectural templates. It contains no executable scripts, shell commands, or obfuscated payloads.
- [DATA_EXFILTRATION]: The skill includes comprehensive guidelines for error tracking with Sentry that prioritize data privacy. In
resources/sentry-and-monitoring.md, it provides a configuration pattern that explicitly redacts request headers, user data, and contextual breadcrumbs before they are transmitted to external monitoring endpoints. - [INDIRECT_PROMPT_INJECTION]: The guidelines establish a defensive posture for handling untrusted data from external sources.
- Ingestion points: Request bodies, query strings, and URL parameters defined in
userRoutes.tsandUserController.ts. - Boundary markers: Explicit instructions in the Resource Guide to capture unexpected errors only at approved, redacted boundaries.
- Capability inventory: File system access for configuration, database mutations via Prisma, and network operations for telemetry and email services.
- Sanitization: The skill mandates strict schema validation via Zod and the use of allowlisted DTOs to ensure that external input cannot influence internal application logic or schema integrity.
- [EXTERNAL_DOWNLOADS]: Dependencies referenced throughout the documentation, such as
express,zod,prisma, and@sentry/node, are industry-standard libraries widely used in secure production environments.
Audit Metadata