The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): Insecure SQL Construction. In references/architecture.md, the UserRepository.update method dynamically builds SQL queries by mapping Object.keys(updates) directly into the SET clause. Because updates is sourced from req.body without key validation, an attacker can inject arbitrary column names into the query, leading to unauthorized data modification or schema manipulation.
[SAFE] (INFO): False Positive Malicious URL Alert. The automated scanner incorrectly identified the logger.info method call in the middleware as a blacklisted URL. This is a benign logging operation.
[SAFE] (LOW): Proper Secret Handling. All sensitive configuration (database passwords, JWT secrets, OAuth client IDs) is managed via environment variables (process.env), adhering to the principle of not hardcoding secrets.
[SAFE] (LOW): Strong Security Baseline. The skill correctly implements and references essential security libraries including bcrypt for password hashing, helmet for security headers, zod for request validation, and express-rate-limit for DDoS/brute-force protection.

nodejs-backend-patterns