nodejs-backend
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and code templates for building Node.js applications using industry-standard libraries and practices. It correctly advocates for using environment variables for secrets and bcrypt for password hashing.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting and processing external data via API endpoints.
- Ingestion points: Data enters the system via REST DTOs (e.g., RegisterDto) and GraphQL input arguments defined in SKILL.md.
- Boundary markers: The architecture uses NestJS pipes, guards, and decorators to validate and scope incoming requests.
- Capability inventory: The instructions involve database operations and job queueing (BullMQ) but no arbitrary shell execution or unsafe dynamic code evaluation.
- Sanitization: The security checklist explicitly requires input validation on all endpoints and XSS sanitization.
Audit Metadata