nestjs-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches NestJS coding standards and rules from the author's official GitHub repository (
somnio-software/somnio-ai-tools) using theWebFetchtool. This is a standard operation for keeping audit rules up to date and targets a trusted vendor resource. - [INDIRECT_PROMPT_INJECTION]: As a code analysis tool, the skill ingests untrusted content from the user's codebase (TypeScript files, tests, DTOs). While this creates a surface for indirect prompt injection where malicious code comments could attempt to influence the audit results, the risk is mitigated by the skill's instructions to report only objective findings with file and line evidence and the limited capabilities (writing reports to a specific directory) granted to the subagents.
Audit Metadata