Skills backend-dev-guidelines

📦

backend-dev-guidelines

Name: backend-dev-guidelines
Author: sickn33

Content revision r2 High Risk 🔑 Env variables📁 Filesystem access🌐 Network access⚙️ External commands

Build Reliable Node.js Backends

Backend changes often become inconsistent across routing, business logic, data access, validation, and monitoring. This skill supplies structured Node.js patterns for reliable implementation and review.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "backend-dev-guidelines" from https://skillstore.io/skills/sickn33-backend-dev-guidelines.md and its manifest at https://skillstore.io/api/skills/sickn33-backend-dev-guidelines/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-backend-dev-guidelines.md Signed manifest GET /api/skills/sickn33-backend-dev-guidelines/manifest Signed lockfile GET /api/skills/sickn33-backend-dev-guidelines/lockfile

Test it

Using "backend-dev-guidelines". Plan a user creation endpoint with email validation.

Expected outcome:

Route delegates the request to UserController.
Controller validates input and calls UserService.
Service enforces uniqueness and invokes UserRepository.
Tests cover success, invalid email, duplicate email, and persistence failure.

Using "backend-dev-guidelines". Review a controller that queries Prisma directly.

Expected outcome:

Finding: the controller bypasses service and repository boundaries.
Risk: business rules and persistence become difficult to test independently.
Recommendation: move decisions into a service and queries into a repository.

Using "backend-dev-guidelines". Design monitoring for a payment workflow.

Expected outcome:

Capture unexpected failures with operation and transaction identifiers.
Redact payment details and credentials before telemetry export.
Measure latency and failure rates without recording sensitive request bodies.

Security Audit

High Risk

v5 • 8/14/2026 Open versioned report

All 219 static alerts are false positives caused by Markdown examples, relative imports, placeholders, and TypeScript syntax. Semantic review found overbroad Sentry collection, plaintext development secrets, and direct client exposure of internal error messages.

Files scanned

5,342

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

resources/sentry-and-monitoring.md:49-85

Overbroad Sentry Data Collection

The recommended setup captures local variables, request bodies, headers, query strings, IP addresses, and user identifiers. Its scrubber removes only two headers and masks one email field.

The enabled integrations and included fields are explicit. Passwords, tokens, and personal data outside the narrow scrubber could reach Sentry.

Medium

resources/configuration.md:160-234

Plaintext Secret Configuration Guidance

The guide places database, JWT, internal API, and client secrets in config.ini and gives that file highest precedence. Gitignore guidance reduces accidental commits but not plaintext exposure.

The configuration examples and precedence rules are explicit. Production uses environment variables, but the recommended development file still stores secrets unencrypted.

Medium

resources/sentry-and-monitoring.md:120-134

Internal Error Messages Returned to Clients

The BaseController example returns error.message directly in HTTP responses. Unexpected exceptions can reveal database details, identifiers, or internal implementation information.

The response assignment is direct and lacks an allowlist of public error types. The exposure depends on which exceptions reach this handler.

Risk Factors

🔑 Env variables (50)

📁 Filesystem access (42)

🌐 Network access (4)

resources/configuration.md:182 resources/configuration.md:186 resources/testing-guide.md:191 resources/testing-guide.md:194

⚙️ External commands (42)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-backend-dev-guidelines/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-backend-dev-guidelines/security.svg)](https://skillstore.io/skills/sickn33-backend-dev-guidelines?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-backend-dev-guidelines?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-backend-dev-guidelines/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-backend-dev-guidelines.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). backend-dev-guidelines security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-backend-dev-guidelines/audits/5

BibTeX citation

@techreport{sickn33-sickn33-backend-dev-guidelines-2026,
  author = {sickn33},
  title = {backend-dev-guidelines security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-backend-dev-guidelines/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "backend-dev-guidelines security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-08-14"
url: "https://skillstore.io/skills/sickn33-backend-dev-guidelines/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-backend-dev-guidelines:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

5 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

DojoCodingLabs Recommended

dojocodinglabs-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 10

Updated

2026-09-09

Dimon94

dimon94-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 8

Updated

2026-09-09

diet103

diet103-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-09-09

sickn33 Current

sickn33-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-09-09

BrianDai22

briandai22-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design a New API Feature

Plan routes, validation, service logic, repository access, error handling, and tests before implementation.

Review Backend Architecture

Identify layer violations, missing validation, direct database access, weak error boundaries, and testing gaps.

Standardize a Service Team

Establish shared conventions for configuration, dependency injection, monitoring, naming, repositories, and pull request review.

Try These Prompts

Plan a Backend Endpoint

Plan a [method] [path] endpoint for [goal]. Include layers, validation, errors, persistence, and tests.

Review a Backend Change

Review [files or diff] against these backend guidelines. List behavioral risks, architecture violations, security concerns, and missing tests.

Design a Transactional Workflow

Design [workflow] using Express, Prisma, and Zod. Define transaction boundaries, idempotency, error mapping, observability, and integration tests.

Refactor a Legacy Feature

Refactor [feature] into routes, controllers, services, and repositories. Preserve behavior, add Zod validation, transaction boundaries, Sentry context, and focused tests.

Best Practices

Describe the existing architecture, dependencies, and acceptance criteria.
Provide relevant routes, schemas, models, errors, and test conventions.
Validate generated changes with project tests, security review, and runtime checks.

Avoid

Do not request a complete rewrite without behavioral constraints.
Do not place business logic, validation, and database calls directly in routes.
Do not adopt telemetry or configuration examples without reviewing secret and privacy handling.