nodejs-express-server
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFE
Full Analysis
- CREDENTIALS_UNSAFE (LOW): The skill contains hardcoded placeholder credentials within the 'Complete Example' section. While intended as examples, these are provided as string literals in security-sensitive functions.
- Evidence:
const sequelize = new Sequelize('postgres://user:pass@localhost/db');inSKILL.md. - Evidence:
jwt.verify(token, 'secret', (err, user) => ...)inSKILL.md. - Indirect Prompt Injection (LOW): The skill defines a surface for processing untrusted data which is subsequently used in database operations without explicit sanitization in the example code.
- Ingestion points:
req.bodyused in POST and PATCH routes inSKILL.md. - Boundary markers: Absent; there are no delimiters or warnings to ignore instructions within the processed request data in the examples.
- Capability inventory: Database write/create operations (
User.create,user.update), file system access (viadotenv), and network listening (app.listen). - Sanitization: Absent in the 'Complete Example'; the code
User.create(req.body)is specifically vulnerable to mass assignment attacks where an attacker can inject unauthorized fields (e.g.,role: 'admin').
Audit Metadata