菜单
检查 RCE、SSRF、SQL 注入、路径穿越等安全问题，支持 Express/Koa/NestJS
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
Archive multiple completed changes at once. Use when archiving several parallel changes.
Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
| id | sec-nodejs-check |
| name | Node.js 安全审查 |
| category | security |
| description | 检查 RCE、SSRF、SQL 注入、路径穿越等安全问题，支持 Express/Koa/NestJS |
| tags | ["security","nodejs","backend","ssrf","sql-injection"] |
| updated_at | "2026-01-20T00:00:00.000Z" |
| allowed-tools | ["Read","Grep","Glob","Shell"] |
/nodejs-security-check # 智能扫描 src 目录
/nodejs-security-check file src/xxx.js # 扫描指定文件
/nodejs-security-check report # 生成详细报告
| 前缀 | 含义 | 处理方式 |
|---|---|---|
🔴 严重 | 可被直接利用 | 阻止发布 |
🟡 中等 | 需特定条件 | 尽快修复 |
⚪ 建议 | 最佳实践 | 可选优化 |
| 维度 | 检查项 |
|---|---|
| 输入验证 | Schema 验证、HPP 防护、请求体限制 |
| 命令执行 | exec/spawn 注入、shell: true |
| 文件操作 | 路径穿越、上传安全、ZipSlip |
| 网络请求 | SSRF、私网阻断、DNS 重绑定 |
| 数据库 | SQL 注入、NoSQL 注入、Mass Assignment |
| 认证授权 | JWT 算法、会话安全、权限校验 |
| 资源 | URI |
|---|---|
| 完整检查清单 | skill://nodejs-security-check/references/checklist.md |
| 修复示例 | skill://nodejs-security-check/references/fix-examples.md |
| 评分标准 | skill://nodejs-security-check/references/scoring-standard.md |
skill://nodejs-security-check/references/checklist.mdskill://nodejs-security-check/references/fix-examples.mdskill://nodejs-security-check/references/report-format.mdskill://nodejs-security-check/references/scoring-standard.mdskill://nodejs-security-check/references/security-toolkit.md根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载