Habilidades nestjs-code-audit

📦

nestjs-code-audit

Name: nestjs-code-audit
Author: amirtaherkhani

v1.0.3 Revisão do conteúdo r1 Seguro 📁 Acesso ao sistema de arquivos⚙️ Comandos externos🔑 Variáveis de ambiente

Audit NestJS Code with Evidence-Backed Findings

NestJS repositories can hide boundary flaws and runtime risks that lint results alone cannot reveal. This skill combines local evidence collection and semantic review into one prioritized report.

Suporta: Claude Codex Code(CC)

🥇 84 Ouro

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "nestjs-code-audit" from https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit.md and its manifest at https://skillstore.io/api/skills/amirtaherkhani-nestjs-code-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/amirtaherkhani-nestjs-code-audit.md manifest assinado GET /api/skills/amirtaherkhani-nestjs-code-audit/manifest lockfile assinado GET /api/skills/amirtaherkhani-nestjs-code-audit/lockfile

Testar

Usando "nestjs-code-audit". Review a payment module where a consumer bypasses the owning service.

Resultado esperado:

Illustrative verdict: pass with risks for the reviewed payment scope.
Architecture finding: a consumer writes through an exported repository without enforcing the owning operation's invariant.
Minimal remedy: route the write through the owning operation.
Validation: add a boundary test proving the invariant remains enforced.

Usando "nestjs-code-audit". Review a NestJS repository with missing local lint and TypeScript executables.

Resultado esperado:

Quality gates: lint and TypeScript were not run because local executables were unavailable.
No dependencies were installed during the audit.
Semantic review remains separate from missing tool results.
Recommended next check: rerun gates after dependencies are available in an approved environment.

Auditoria de segurança

Seguro

v1 • 04/10/2026 Abrir o relatório versionado

Most static findings match Markdown, JavaScript strings, or ordinary repository inspection rather than threats. Optional checks execute repository-controlled tooling and pass inherited environment variables, creating execution and credential exposure risks. No evidence found of intentional exfiltration or prompt injection in the reviewed files.

Arquivos analisados

839

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Itens de revisão de capacidade (2)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

scripts/collect-quality-evidence.mjs:234

Synchronous spawn

const result = spawnSync(command, args, {

With --run, this executes repository-local binaries and ESLint configuration or plugins without isolation. Non-fixing flags do not prevent malicious tooling from writing files or making network requests.

Médio

scripts/collect-quality-evidence.mjs:237

Environment variable object

env: { ...process.env, CI: '1', FORCE_COLOR: '0', NO_COLOR: '1' },

The runner copies every parent environment variable into repository-controlled tools and ESLint plugins. Any inherited credentials become available to that executable code.

Fatores de risco

📁 Acesso ao sistema de arquivos (4)

references/check-policy.md:7 scripts/collect-quality-evidence.mjs:7 scripts/collect-quality-evidence.mjs:134 scripts/collect-quality-evidence.mjs:192

⚙️ Comandos externos (50)

🔑 Variáveis de ambiente (2)

references/report-template.md:47 scripts/collect-quality-evidence.mjs:237

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/amirtaherkhani-nestjs-code-audit/security.svg)](https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/amirtaherkhani-nestjs-code-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/amirtaherkhani-nestjs-code-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

amirtaherkhani. (2026). nestjs-code-audit security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit/audits/1

Citação BibTeX

@techreport{amirtaherkhani-amirtaherkhani-nestjs-code-audit-2026,
  author = {amirtaherkhani},
  title = {nestjs-code-audit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nestjs-code-audit security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "amirtaherkhani"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/amirtaherkhani-nestjs-code-audit/audits/1"
identifiers:
  - type: other
    value: "skillstore:amirtaherkhani-nestjs-code-audit:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

100

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Review a Feature Module

Inspect a scoped module for dependency leaks, misplaced invariants, and missing boundary tests before changing its implementation.

Assess Repository Readiness

Review architecture, runtime controls, and available quality gates to prioritize repository improvements before a release.

Inspect Authorization Boundaries

Trace authentication, resource ownership, tenant isolation, and response handling while separating proven risks from missing evidence.

Teste estes prompts

Start a Repository Review

Use nestjs-code-audit to review this NestJS repository without changes or command execution. Report confirmed problems and checks that were not run.

Review a Scoped Module

Audit src/payments in architecture mode without running project tools. Trace consumers and transaction ownership; report evidence, impact, remedies, and validation steps.

Review Security Controls

Audit src/auth in security mode without live service checks. Trace guards, validation, tenant ownership, and output contracts; separate confirmed risks from verification needs.

Combine Gates and Semantic Review

Perform a full NestJS audit. Inspect local tooling and configuration first; run checks only after explicit approval in isolation with credentials removed.

Boas práticas

Define the review scope and preserve existing changes before collecting evidence.
Inspect local binaries and configuration before checks; use isolation and remove credentials when executing project tooling.
Require file locations, call paths, impact, remedies, and validation for every confirmed finding.

Evitar

Treating a heuristic match, long file, or architectural preference as a confirmed defect.
Running untrusted project tooling because non-fixing flags appear safe.
Interpreting missing checks or clean lint output as proof of application security.

Perguntas frequentes

Does this skill fix code?

No. It produces an audit report; implementation requires a separately authorized phase.

Are specialist sibling skills required?

No. Bundled semantic references support standalone review; installed specialist skills can provide deeper guidance.

Which tools can use this skill?

The skill supports Claude, Codex, and Claude Code. The bundled collector requires Node.js 20 or later.

What happens when dependencies are missing?

Unavailable checks are marked not run. The audit does not install dependencies or treat missing checks as passes.

Does a scoped audit limit every compiler check?

No. Source review and lint use the requested scope, while TypeScript checks the repository configuration as a whole.

Are optional checks guaranteed to be read-only?

No. ESLint configuration, plugins, and local binaries can execute code. Inspect them and use isolation with credentials removed before running checks.