Skills nodejs-backend-patterns

📦

nodejs-backend-patterns

Name: nodejs-backend-patterns
Author: sickn33

Content revision r2 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build Production-Ready Node.js Backends

Backend projects often lack consistent architecture, security, and operational patterns. This skill provides TypeScript examples for APIs, data access, authentication, caching, and error handling.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "nodejs-backend-patterns" from https://skillstore.io/skills/sickn33-nodejs-backend-patterns.md and its manifest at https://skillstore.io/api/skills/sickn33-nodejs-backend-patterns/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-nodejs-backend-patterns.md Signed manifest GET /api/skills/sickn33-nodejs-backend-patterns/manifest Signed lockfile GET /api/skills/sickn33-nodejs-backend-patterns/lockfile

Test it

Using "nodejs-backend-patterns". Design the architecture for a user management API using Express and PostgreSQL.

Expected outcome:

A layered structure separating routes, controllers, services, and repositories.
Validation and authentication middleware placed before controller handlers.
Parameterized repository operations with transactions for multi-step changes.
Central error handling, structured logs, health checks, and graceful shutdown.

Using "nodejs-backend-patterns". Review my JWT login and refresh flow for production risks.

Expected outcome:

A prioritized review covering secret validation, token lifetime, rotation, revocation, and replay protection.
Recommendations for generic credential errors, authentication rate limits, secure storage, and audit logging.
A verification checklist for expired, revoked, reused, and malformed tokens.

Using "nodejs-backend-patterns". Improve Redis cache invalidation for a large Node.js service.

Expected outcome:

A bounded invalidation approach using namespaces, cursor scanning, batch deletion, metrics, and clear ownership of cache keys.

Security Audit

High Risk

v5 • 8/4/2026 Open versioned report

Most static alerts are false positives caused by Markdown, TypeScript imports, template literals, environment configuration, and database examples. The all-interface network bind is a contextual exposure, and the playbook also contains unsafe SQL identifier interpolation, permissive CORS, and blocking Redis invalidation guidance.

Files scanned

1,064

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

resources/implementation-playbook.md:266-281

Unvalidated SQL Identifier Interpolation

The update example builds SQL column assignments from Object.keys(updates). Parameterized values do not protect interpolated identifiers, so unexpected request keys can alter the query.

The field names are directly interpolated into SQL while only values use placeholders. The example shows no runtime allowlist for accepted update keys.

Medium

resources/implementation-playbook.md:73-76

Permissive Fastify CORS Configuration

The Fastify example reflects any request origin through origin: true. Production use can grant untrusted websites cross-origin access unless routes are strictly public.

The configuration explicitly enables dynamic origin reflection. The same playbook later warns against unrestricted production CORS, confirming this example needs qualification.

Medium

resources/implementation-playbook.md:911-915

Blocking Redis Pattern Invalidation

The cache example uses Redis KEYS with an arbitrary pattern, then deletes every match. Large keyspaces or broad patterns can block Redis and remove unrelated cache entries.

The method accepts any pattern and directly calls KEYS followed by bulk deletion. Redis KEYS is synchronously expensive across large keyspaces.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

resources/implementation-playbook.md:98

Hardcoded IP address

await fastify.listen({ port: 3000, host: '0.0.0.0' });

The example binds Fastify to 0.0.0.0, exposing the service on every available interface. This is valid for containers but requires explicit network controls.

Risk Factors

⚡ Contains scripts (1)

resources/implementation-playbook.md:563

⚙️ External commands (10)

resources/implementation-playbook.md:44-50 resources/implementation-playbook.md:50-52 resources/implementation-playbook.md:245-271 resources/implementation-playbook.md:271-274 resources/implementation-playbook.md:279-291 resources/implementation-playbook.md:314-359 resources/implementation-playbook.md:538-548 resources/implementation-playbook.md:930-946 SKILL.md:34 SKILL.md:38

🌐 Network access (1)

resources/implementation-playbook.md:98

📁 Filesystem access (11)

resources/implementation-playbook.md:123 resources/implementation-playbook.md:124 resources/implementation-playbook.md:175 resources/implementation-playbook.md:176 resources/implementation-playbook.md:177 resources/implementation-playbook.md:235 resources/implementation-playbook.md:369 resources/implementation-playbook.md:434 resources/implementation-playbook.md:604 resources/implementation-playbook.md:800 resources/implementation-playbook.md:801

🔑 Env variables (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-nodejs-backend-patterns/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-nodejs-backend-patterns/security.svg)](https://skillstore.io/skills/sickn33-nodejs-backend-patterns?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-nodejs-backend-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-nodejs-backend-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-nodejs-backend-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). nodejs-backend-patterns security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-nodejs-backend-patterns/audits/5

BibTeX citation

@techreport{sickn33-sickn33-nodejs-backend-patterns-2026,
  author = {sickn33},
  title = {nodejs-backend-patterns security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-nodejs-backend-patterns/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nodejs-backend-patterns security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-08-04"
url: "https://skillstore.io/skills/sickn33-nodejs-backend-patterns/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-nodejs-backend-patterns:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-nodejs-backend-patterns

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 17

Updated

2026-08-21

sickn33 Current

sickn33-nodejs-backend-patterns

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design a New API

Create a maintainable Express or Fastify service structure with clear HTTP, business, and data boundaries.

Standardize a Growing Service

Refactor middleware, errors, dependencies, and repositories into consistent patterns that support team development.

Review Production Readiness

Assess authentication, validation, rate limits, logging, database pooling, caching, and shutdown behavior before release.

Try These Prompts

Choose a Backend Framework

Compare Express and Fastify for my API. Consider team experience, performance, validation, plugins, deployment, and maintenance. Recommend one with clear reasons.

Create a Layered API Design

Design a TypeScript Node.js API for [domain]. Define routes, controllers, services, repositories, validation, errors, dependencies, and a practical folder structure.

Add Secure Authentication

Design authentication and authorization for [application]. Include password hashing, access tokens, refresh rotation, role checks, secret validation, rate limits, and failure responses.

Audit Backend Production Readiness

Review this Node.js backend architecture for production. Identify security, reliability, scaling, data integrity, observability, caching, and shutdown risks. Prioritize concrete fixes.

Best Practices

Provide framework, database, deployment, and traffic constraints before requesting an architecture.
Validate generated patterns against current package documentation and local security requirements.
Request tests and operational verification for authentication, transactions, caching, and shutdown paths.

Avoid

Do not apply every pattern when a simpler service structure meets the requirements.
Do not copy examples without validating inputs, secrets, origins, SQL identifiers, and network exposure.
Do not treat TypeScript types as runtime validation for untrusted requests.

Frequently Asked Questions

Does this skill generate a complete backend application?

No. It provides architecture guidance and implementation patterns that must be adapted, integrated, and tested.

Which Node.js frameworks does it cover?

It includes direct examples for Express and Fastify, with patterns that can inform other Node.js frameworks.

Does it support SQL and NoSQL databases?

Yes. The playbook covers PostgreSQL pooling and transactions, MongoDB with Mongoose, and Redis caching.

Can it help with authentication?

Yes. It covers password hashing, JWT verification, access and refresh tokens, role authorization, and authentication rate limits.

Is the guidance ready for direct production use?

No. Review package versions, runtime validation, CORS, secret handling, SQL construction, caching, and deployment controls first.

Does it include testing patterns?

Only a short testing recommendation is included. Detailed unit, integration, and end-to-end testing guidance is outside this skill.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nodejs-backend-patterns

Ref

81e05e636292629114b76cbb3922fbe57672fc02

Maintenance freshness

8/5/2026

Usage

10 downloads · 134 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md