菜单
Hardens Node.js HTTP services: input validation, secure headers, authentication/authorization basics, secret handling, and dependency hygiene. Use when shipping to production or reviewing a service for security gaps.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | securing-nodejs-apps |
| description | Hardens Node.js HTTP services: input validation, secure headers, authentication/authorization basics, secret handling, and dependency hygiene. Use when shipping to production or reviewing a service for security gaps. |
npm audit, no known vulnerabilitiesimport { z } from 'zod';
export const CreateUserSchema = z.object({
email: z.string().email().toLowerCase(),
password: z.string().min(12),
name: z.string().min(2).max(100),
});
export type CreateUserDto = z.infer<typeof CreateUserSchema>;
// ❌ Never
const jwtSecret = 'my-secret';
// ✅ Always
import { config } from '@shared/config';
const jwtSecret = config.JWT_SECRET; // Loaded once, validated
// Validate input at boundary
const parsed = CreateUserSchema.safeParse(req.body);
if (!parsed.success) return res.status(400).json({ errors: parsed.error.format() });
// ❌ No validation
app.post('/user', (req, res) => { db.save(req.body); });
// ❌ Secret in code
const apiKey = 'sk_live_12345';
npm audit passesSee reference/security-patterns.md for full patterns.
Defines the rule base every skill in this pack obeys: file layout, frontmatter, vocabulary, OOP/typing/decoupling axioms, and anti-patterns. Load FIRST before authoring or applying any other skill in this pack.
Designs NestJS feature modules with clean dependency boundaries, provider scopes, and dynamic modules. Use when adding a new feature module, splitting a monolithic AppModule, or fixing tangled imports between modules.
Builds thin NestJS controllers that parse input, invoke a single use case, and map the Result to ApiResponse<T>. Use when adding HTTP endpoints, refactoring fat controllers, or applying API versioning.
Prepares a NestJS service for production: graceful shutdown, health/readiness, structured logs, config, Dockerfile, CI gates, and rollout safety. Use when promoting a service to staging/production or auditing readiness.
Designs NestJS application services as use-case classes that orchestrate domain logic and ports without leaking the framework. Use when creating new use cases, refactoring services that mix HTTP/DB/domain, or moving from anemic services to OOP.
Maps internal AppError hierarchy to HTTP responses through a single global exception filter and a Result-to-HttpException helper. Use when adding new error types, fixing inconsistent error responses, or removing scattered try/catch in controllers.