Skills backend-dev-guidelines

📦

backend-dev-guidelines

Name: backend-dev-guidelines
Author: Dimon94

Content revision r1 Medium Risk 🔑 Env variables📁 Filesystem access🌐 Network access⚙️ External commands

Build Consistent TypeScript Backends

Backend services often drift into mixed patterns and hard-to-test code. This skill gives Claude, Codex, and Claude Code structured guidance for Express, Prisma, validation, monitoring, and tests.

Supports: Claude Codex Code(CC)

📊 70 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "backend-dev-guidelines" from https://skillstore.io/skills/dimon94-backend-dev-guidelines.md and its manifest at https://skillstore.io/api/skills/dimon94-backend-dev-guidelines/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dimon94-backend-dev-guidelines.md Signed manifest GET /api/skills/dimon94-backend-dev-guidelines/manifest Signed lockfile GET /api/skills/dimon94-backend-dev-guidelines/lockfile

Test it

Using "backend-dev-guidelines". A user route contains validation, database writes, and response formatting in one handler.

Expected outcome:

A refactoring plan separates routing, controller logic, service rules, and repository access.
The controller handles request parsing, Zod validation, success responses, and error delegation.
The service owns business rules and calls a repository for Prisma operations.

Using "backend-dev-guidelines". A service needs consistent error tracking and async handling.

Expected outcome:

The response recommends try-catch boundaries, specific custom errors, and Sentry capture points.
It notes where sensitive context should be reduced before sending telemetry.
It suggests tests for success, validation failure, repository failure, and authorization failure.

Using "backend-dev-guidelines". A team wants one pattern for configuration across microservices.

Expected outcome:

The guidance recommends centralized typed configuration, startup validation, production environment variables, and avoiding scattered direct environment access.

Security Audit

Medium Risk

v8 • 7/5/2026 Open versioned report

Static scanner hits are false positives from Markdown guidance, TypeScript imports, placeholders, and code examples rather than executable skill behavior. No prompt-injection text was found. A medium semantic issue remains because the Sentry template may over-collect request and user telemetry if copied without stronger scrubbing.

Files scanned

5,292

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

resources/sentry-and-monitoring.md:19-21 resources/sentry-and-monitoring.md:52-60 resources/sentry-and-monitoring.md:74-83 resources/sentry-and-monitoring.md:263-268

Overbroad Sentry Telemetry Template

The Sentry setup requires all errors to be captured and enables request data, headers, IP address, query string, URL, and user identity fields. The template scrubs authorization and cookie headers, but it can still send sensitive request bodies, query parameters, custom headers, and user data to a third-party service if copied directly.

The cited template explicitly enables broad request and user context capture while only removing authorization and cookie headers. This is a clear privacy and data exposure risk, although the file also warns against sending passwords.

Risk Factors

🔑 Env variables (52)

📁 Filesystem access (42)

🌐 Network access (4)

resources/configuration.md:182 resources/configuration.md:186 resources/testing-guide.md:191 resources/testing-guide.md:194

⚙️ External commands (33)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dimon94-backend-dev-guidelines/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dimon94-backend-dev-guidelines/security.svg)](https://skillstore.io/skills/dimon94-backend-dev-guidelines?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dimon94-backend-dev-guidelines?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dimon94-backend-dev-guidelines/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dimon94-backend-dev-guidelines.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dimon94. (2026). backend-dev-guidelines security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dimon94-backend-dev-guidelines/audits/8

BibTeX citation

@techreport{dimon94-dimon94-backend-dev-guidelines-2026,
  author = {Dimon94},
  title = {backend-dev-guidelines security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dimon94-backend-dev-guidelines/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "backend-dev-guidelines security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Dimon94"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dimon94-backend-dev-guidelines/audits/8"
identifiers:
  - type: other
    value: "skillstore:dimon94-backend-dev-guidelines:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

5 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

DojoCodingLabs Recommended

dojocodinglabs-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

Dimon94 Current

dimon94-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 6

Updated

2026-08-21

diet103

diet103-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

sickn33

sickn33-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

BrianDai22

briandai22-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a New API Feature

Use the route, controller, service, validation, and repository patterns to add a feature with consistent structure.

Refactor Legacy Routes

Move business logic out of large Express route files into controllers and services with clearer responsibilities.

Standardize Service Quality

Apply shared rules for configuration, Sentry monitoring, Prisma access, async errors, and backend test coverage.

Try These Prompts

Plan a Backend Feature

Using the backend development guidelines, outline the route, controller, service, validation, repository, and test files for a new feature.

Review an Express Route

Review this Express route against the backend guidelines. Identify business logic, validation gaps, error handling gaps, and a refactoring plan.

Design Prisma Access

Design the service and repository layer for this Prisma workflow. Include transaction boundaries, query optimization, errors, and unit test strategy.

Audit Observability and Config

Evaluate this backend service against the guidelines for unifiedConfig, Sentry instrumentation, async error handling, middleware order, and sensitive data exposure.

Best Practices

Use the guidelines as a review checklist before generating or changing backend code.
Adapt service names, paths, and domain models to the target repository before applying examples.
Review telemetry, secrets, and authentication behavior before merging generated backend changes.

Avoid

Do not copy examples without checking security-sensitive defaults and project-specific middleware.
Do not keep business logic, validation, and database writes inside route handlers.
Do not send full request bodies, secrets, or sensitive user details to monitoring tools.