Skills nodejs-backend-patterns
📦
nodejs-backend-patterns
Content revision r1 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build Production Node.js Backends
Node.js backend projects need consistent structure, secure middleware, and database patterns. This skill provides practical Express and Fastify guidance for production API work.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "nodejs-backend-patterns" from https://skillstore.io/skills/wshobson-nodejs-backend-patterns.md and its manifest at https://skillstore.io/api/skills/wshobson-nodejs-backend-patterns/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "nodejs-backend-patterns". Design a user management API with Express and PostgreSQL.
Expected outcome:
- A layered architecture plan with route, controller, service, and repository responsibilities.
- Middleware recommendations for validation, authentication, logging, compression, and error handling.
- Database guidance for connection pooling, parameterized queries, and user response shaping.
Using "nodejs-backend-patterns". Add JWT authentication and refresh tokens to an existing Node.js service.
Expected outcome:
- A login flow using password hashing, consistent unauthorized errors, and token generation.
- Authentication middleware that verifies bearer tokens before protected routes.
- Refresh token guidance that should be adapted with rotation and storage controls.
Using "nodejs-backend-patterns". Improve production readiness for a Fastify backend.
Expected outcome:
- A checklist for security middleware, CORS restrictions, structured logging, rate limiting, and health checks.
- Database and cache recommendations for pooling, graceful shutdown, retries, and safe invalidation.
- Error handling guidance that avoids exposing internal details in production responses.
Security Audit
High Riskv8 • 7/8/2026 Open versioned report
Most static findings are false positives caused by Markdown code fences, TypeScript imports, and normal environment configuration examples. One static network finding is confirmed because the Fastify example binds to all interfaces, and semantic review found unsafe dynamic SQL, permissive CORS, and unbounded Redis key deletion guidance.
1
Files scanned
1,021
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Unsafe Dynamic SQL Column Interpolation
The update flow accepts request body updates and converts their keys into a SQL SET clause without an allowlist. A malicious field name could alter the generated SQL if this pattern is copied into production.
The data flow is visible from req.body updates to Object.keys(updates) and direct interpolation into SET ${setClause}. Parameter binding protects values, but not interpolated column identifiers.
Medium
Permissive CORS Example
The Fastify setup registers CORS with origin true, which can allow arbitrary origins. Authenticated APIs should restrict origins to an explicit allowlist.
The permissive origin setting is explicit. It may be acceptable for limited public APIs, but it is unsafe as broad backend guidance.
Medium
Unbounded Redis Key Pattern Deletion
The cache service accepts a pattern, calls Redis KEYS, and deletes every matching key. This can cause latency spikes or broad cache deletion if the pattern is influenced by untrusted input.
The method directly uses a caller-supplied pattern with KEYS and bulk deletion. The risk depends on call sites, which are not shown in the skill.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Hardcoded IP address
await fastify.listen({ port: 3000, host: '0.0.0.0' });
The Fastify example binds to 0.0.0.0, which exposes the listener on all network interfaces when copied directly. This can be valid in containers, but the guidance lacks a local-development warning or environment gate.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (47)
SKILL.md:26-45 SKILL.md:45-51 SKILL.md:51-53 SKILL.md:53-58 SKILL.md:58-100 SKILL.md:100-107 SKILL.md:107-118 SKILL.md:118-121 SKILL.md:121-171 SKILL.md:171-174 SKILL.md:174-230 SKILL.md:230-233 SKILL.md:233-242 SKILL.md:246-272 SKILL.md:272-275 SKILL.md:280-292 SKILL.md:292-297 SKILL.md:297-315 SKILL.md:315-360 SKILL.md:360-366 SKILL.md:366-427 SKILL.md:427-431 SKILL.md:431-472 SKILL.md:472-476 SKILL.md:476-508 SKILL.md:508-512 SKILL.md:512-539 SKILL.md:539-549 SKILL.md:549-555 SKILL.md:555-598 SKILL.md:598-602 SKILL.md:602-649 SKILL.md:649-655 SKILL.md:655-687 SKILL.md:687-691 SKILL.md:691-743 SKILL.md:743-747 SKILL.md:747-791 SKILL.md:791-797 SKILL.md:797-876 SKILL.md:876-880 SKILL.md:880-931 SKILL.md:931-947 SKILL.md:947-951 SKILL.md:951-991 SKILL.md:991-1002 SKILL.md:1002-1013
🌐 Network access (5)
📁 Filesystem access (11)
🔑 Env variables (50)
SKILL.md:36 SKILL.md:49 SKILL.md:66 SKILL.md:335 SKILL.md:336 SKILL.md:337 SKILL.md:338 SKILL.md:339 SKILL.md:399 SKILL.md:483 SKILL.md:484 SKILL.md:518 SKILL.md:631 SKILL.md:660 SKILL.md:661 SKILL.md:662 SKILL.md:663 SKILL.md:664 SKILL.md:697 SKILL.md:844 SKILL.md:865 SKILL.md:871 SKILL.md:885 SKILL.md:886 SKILL.md:36 SKILL.md:49 SKILL.md:66 SKILL.md:335 SKILL.md:336 SKILL.md:337 SKILL.md:338 SKILL.md:339 SKILL.md:399 SKILL.md:483 SKILL.md:484 SKILL.md:518 SKILL.md:631 SKILL.md:660 SKILL.md:661 SKILL.md:662 SKILL.md:663 SKILL.md:664 SKILL.md:697 SKILL.md:844 SKILL.md:865 SKILL.md:871 SKILL.md:885 SKILL.md:886 SKILL.md:339 SKILL.md:664
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/wshobson-nodejs-backend-patterns/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/wshobson-nodejs-backend-patterns?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/wshobson-nodejs-backend-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-nodejs-backend-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/wshobson-nodejs-backend-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
wshobson. (2026). nodejs-backend-patterns security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-nodejs-backend-patterns/audits/8BibTeX citation
@techreport{wshobson-wshobson-nodejs-backend-patterns-2026,
author = {wshobson},
title = {nodejs-backend-patterns security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/wshobson-nodejs-backend-patterns/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nodejs-backend-patterns security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "wshobson"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/wshobson-nodejs-backend-patterns/audits/8"
identifiers:
- type: other
value: "skillstore:wshobson-nodejs-backend-patterns:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
wshobson-nodejs-backend-patterns
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated
2026-08-21
sickn33-nodejs-backend-patterns
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
72
Community
70
Spec Compliance
What You Can Build
Design a New REST API
Plan an Express or Fastify service with routes, controllers, services, repositories, middleware, and response conventions.
Add Authentication to an App
Use the patterns to structure JWT login, refresh tokens, password hashing, authentication middleware, and role checks.
Standardize Backend Architecture
Create shared conventions for service layers, database access, error handling, caching, and production readiness.
Try These Prompts
Create a Basic API
Use nodejs-backend-patterns to design a simple Express API for users. Include routes, middleware, validation, and error handling.
Structure Service Layers
Use nodejs-backend-patterns to design a layered Node.js backend for orders. Include controllers, services, repositories, database access, and response patterns.
Add Production Middleware
Use nodejs-backend-patterns to add authentication, authorization, request logging, rate limiting, validation, and global error handling to an existing Fastify service.
Review Backend Architecture
Use nodejs-backend-patterns to review my Node.js API architecture. Identify gaps in middleware, database handling, caching, authentication, and production operations.
Best Practices
- Adapt examples to your project security model before using them in production.
- Keep validation, authorization, and database access centralized in clear application layers.
- Use environment variables for secrets, but protect them from logs, responses, and client-side exposure.
Avoid
- Do not copy sample database update builders without allowlisting writable fields.
- Do not use permissive CORS settings for authenticated production APIs.
- Do not expose internal errors, stack traces, or secret configuration in API responses.
Frequently Asked Questions
Does this skill create a complete backend project?
No. It provides architecture patterns and examples that you adapt inside your own Node.js project.
Can it help with both Express and Fastify?
Yes. It includes setup and middleware patterns for Express and Fastify services.
Does it cover authentication?
Yes. It includes JWT login, refresh token, password hashing, authentication middleware, and authorization examples.
Does it include database guidance?
Yes. It covers PostgreSQL, MongoDB, Redis caching, transactions, and connection pooling patterns.
Is the guidance production ready as written?
No. Review CORS, SQL update builders, cache invalidation, secrets, and deployment settings before production use.
Can I use it with Claude, Codex, and Claude Code?
Yes. The skill metadata lists support for Claude, Codex, and Claude Code.