backend-agent
Build Secure Unite-Hub Backend Features
Backend changes can break data isolation, authentication, or integrations. This skill guides Claude, Codex, and Claude Code through secure Unite-Hub backend work.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "backend-agent" from https://skillstore.io/skills/cleanexpo-backend-agent.md and its manifest at https://skillstore.io/api/skills/cleanexpo-backend-agent/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "backend-agent". Fix an API route that returns contacts from every workspace.
Expected outcome:
The response should explain the data isolation bug, add workspace and organization filters, require authentication, and include a test plan.
Using "backend-agent". Create a bulk contact update endpoint.
Expected outcome:
The response should outline request validation, role checks, field allow-listing, workspace filtering, audit logging, and safe error responses.
Using "backend-agent". Add RLS policies for a new campaigns table.
Expected outcome:
The response should describe policies for each operation, membership checks, indexes, and tests using users from different workspaces.
Security Audit
Medium RiskMost static alerts are false positives caused by Markdown code fences, inline backticks, and ordinary environment variable examples. No prompt override text, malware behavior, or credential exfiltration instructions were found. Two semantic issues remain in example backend patterns: mass assignment in bulk updates and untrusted CRM history inside AI prompts.
Confirmed security concerns (2)
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (58)
🔑 Env variables (9)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cleanexpo-backend-agent/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cleanexpo-backend-agent?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cleanexpo-backend-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cleanexpo-backend-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cleanexpo-backend-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CleanExpo. (2026). backend-agent security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cleanexpo-backend-agent/audits/8BibTeX citation
@techreport{cleanexpo-cleanexpo-backend-agent-2026,
author = {CleanExpo},
title = {backend-agent security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/cleanexpo-backend-agent/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "backend-agent security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CleanExpo"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cleanexpo-backend-agent/audits/8"
identifiers:
- type: other
value: "skillstore:cleanexpo-backend-agent:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Create Workspace-Scoped API Routes
Build a Next.js endpoint that validates input, checks authentication, filters by workspace, and returns structured errors.
Harden Supabase Data Access
Review queries and RLS policies so users only access records for their workspace and organization.
Add Service Integrations
Implement Gmail or Claude service calls with server-side secrets, typed inputs, and controlled error handling.
Try These Prompts
Review this Unite-Hub API route. Identify missing authentication, workspace filtering, input validation, and error handling. Return a prioritized fix list.
Create a Next.js API endpoint for this feature. Include authentication, workspace scope, input validation, audit logging, and structured errors.
Design Supabase RLS policies for this table. Cover select, insert, update, and delete access using workspace and organization membership.
Review this Gmail or Claude integration design. Check secret handling, token scope, prompt injection risk, logging, retries, and failure modes.
Best Practices
- Always apply workspace and organization filters to data queries.
- Validate request input before database mutations or external API calls.
- Keep secrets server-side and exclude sensitive values from logs and responses.
Avoid
- Do not create public API routes unless the public access requirement is explicit.
- Do not pass arbitrary request fields directly into database updates.
- Do not trust CRM text or email content as model instructions.