Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

security-audit

Estrellas31

Forks6

Actualizado15 de julio de 2026 a las 11:54

Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

KhaledSaeed18

KhaledSaeed18/node-express-boilerplate

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	security-audit
description	Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.

Audit the codebase against this project's security architecture. Report findings ordered by severity with file:line references; do not change code unless asked.

1. Authentication & tokens

JWT access/refresh tokens must be delivered as signed HttpOnly cookies (src/services/auth.service.ts, cookie options in the auth controller). Flag any token exposed in a JSON body or non-HttpOnly cookie.
Cookie flags: httpOnly: true, secure in production, sameSite set, correct maxAge matching token expiry.
Refresh-token rotation: refresh must invalidate/replace the old token, never extend it silently.
protect middleware (src/middleware/auth.middleware.ts) applied to every non-public route; 401 for unauthenticated, 403 for authenticated-but-forbidden.
Ownership checks in services: a user must never read/update/delete another user's records (check every repository query filters by userId).

2. CSRF

doubleCsrfProtection applied to all mutating routes (POST/PUT/PATCH/DELETE) in every file in src/routes/.
Token endpoint GET /auth/csrf-token must not itself be state-changing.

3. Rate limiting & headers

Every route group attaches a limiter from src/middleware/limiter.middleware.ts; auth routes must have the strictest limit.
helmet and CORS configured in src/app.ts; CORS origin must come from config, never * with credentials.
trust proxy set correctly so limiters key on the real client IP.

4. Input validation & output shaping

Every POST/PUT/PATCH route has a Zod validation middleware from src/validations/.
Params/query used in queries (ids, pagination) are validated, not passed raw.
Services map entities through toResponseDTO() — flag any handler returning a raw Prisma entity (risk: leaking password, token hashes, internal fields).
Error responses come only from src/errors/ + global error middleware; flag any res.status().json() on an error path (risk: inconsistent shape, stack leaks). Error middleware must not expose stack traces or Prisma error details in production.

5. Secrets & config

No process.env outside src/config/env.ts; all secrets validated by the Zod env schema with no insecure defaults for JWT_SECRET/cookie secrets.
.env gitignored; .env.example contains placeholders only. Scan the repo for hardcoded credentials, API keys, or connection strings.
Logger (src/config/logger.ts) redacts sensitive fields (authorization headers, cookies, passwords).

6. Dependencies & platform

pnpm audit --prod

Flag high/critical advisories with the upgrade path.
Dockerfile: runs as non-root user, multi-stage build, no secrets baked into layers.
CI: CodeQL/security workflows present in .github/workflows/ and passing.

Output format

For each finding: severity (critical/high/medium/low) — title — file:line — why it matters — recommended fix. End with a short summary of what was checked and found clean.

Más de este repositorio

mismo repositorio

add-middleware

KhaledSaeed18/node-express-boilerplate

Add a new Express middleware to this project and wire it up correctly. Use when the user asks to add middleware — rate limiting, request guards, validation, logging enrichment, custom auth checks, etc.

2026-07-1531

add-openapi-docs

KhaledSaeed18/node-express-boilerplate

Add or update OpenAPI 3.1 documentation for API endpoints in src/docs/. Use when the user asks to document endpoints, add Swagger/OpenAPI docs, or when a new resource or route was added without docs.

2026-07-1531

add-test

KhaledSaeed18/node-express-boilerplate

Scaffold unit and integration tests for an existing resource or service. Use when the user asks to add tests, write tests, or improve test coverage for a specific resource, service, controller, or route.

2026-07-1531

new-resource

KhaledSaeed18/node-express-boilerplate

Scaffold a complete new API resource (validation → repository → service → controller → route → container → app mount → OpenAPI → tests). Use when the user asks to add a new resource, entity, model, or endpoint group to the API.

2026-07-1531

update-schema

KhaledSaeed18/node-express-boilerplate

Update the Prisma schema to add a new model, add fields to an existing model, or change relations — then run migration and regenerate the client. Use when the user asks to add a field, add a model, change a relation, or update the database schema.

2026-07-1531

name	security-audit
description	Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.

Audit the codebase against this project's security architecture. Report findings ordered by severity with file:line references; do not change code unless asked.

1. Authentication & tokens

JWT access/refresh tokens must be delivered as signed HttpOnly cookies (src/services/auth.service.ts, cookie options in the auth controller). Flag any token exposed in a JSON body or non-HttpOnly cookie.
Cookie flags: httpOnly: true, secure in production, sameSite set, correct maxAge matching token expiry.
Refresh-token rotation: refresh must invalidate/replace the old token, never extend it silently.
protect middleware (src/middleware/auth.middleware.ts) applied to every non-public route; 401 for unauthenticated, 403 for authenticated-but-forbidden.
Ownership checks in services: a user must never read/update/delete another user's records (check every repository query filters by userId).

2. CSRF

doubleCsrfProtection applied to all mutating routes (POST/PUT/PATCH/DELETE) in every file in src/routes/.
Token endpoint GET /auth/csrf-token must not itself be state-changing.

3. Rate limiting & headers

Every route group attaches a limiter from src/middleware/limiter.middleware.ts; auth routes must have the strictest limit.
helmet and CORS configured in src/app.ts; CORS origin must come from config, never * with credentials.
trust proxy set correctly so limiters key on the real client IP.

4. Input validation & output shaping

Every POST/PUT/PATCH route has a Zod validation middleware from src/validations/.
Params/query used in queries (ids, pagination) are validated, not passed raw.
Services map entities through toResponseDTO() — flag any handler returning a raw Prisma entity (risk: leaking password, token hashes, internal fields).
Error responses come only from src/errors/ + global error middleware; flag any res.status().json() on an error path (risk: inconsistent shape, stack leaks). Error middleware must not expose stack traces or Prisma error details in production.

5. Secrets & config

No process.env outside src/config/env.ts; all secrets validated by the Zod env schema with no insecure defaults for JWT_SECRET/cookie secrets.
.env gitignored; .env.example contains placeholders only. Scan the repo for hardcoded credentials, API keys, or connection strings.
Logger (src/config/logger.ts) redacts sensitive fields (authorization headers, cookies, passwords).

6. Dependencies & platform

pnpm audit --prod

Flag high/critical advisories with the upgrade path.
Dockerfile: runs as non-root user, multi-stage build, no secrets baked into layers.
CI: CodeQL/security workflows present in .github/workflows/ and passing.

Output format

For each finding: severity (critical/high/medium/low) — title — file:line — why it matters — recommended fix. End with a short summary of what was checked and found clean.