Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Node.js 安全审查 — measured AI agent skill | DecimalAI

tencentblueking/Node.js 安全审查

NewSkillScoreMaintained

检查 RCE、SSRF、SQL 注入、路径穿越等安全问题，支持 Express/Koa/NestJS

Securityby tencentblueking

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/tencentblueking-node-js/SKILL.md

decimalai skills pull tencentblueking-node-js --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/tencentblueking-node-js/SKILL.md https://app.decimal.ai/s/tencentblueking-node-js/SKILL.md

Raw file: /s/tencentblueking-node-js/SKILL.md ↗ · machine-readable summary at /s/tencentblueking-node-js.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 3h ago

Yes — +14% lift+21% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	35%	0%
case-18	✗→✓	▲ Improved	16%	0%
case-21	✗→✓	▲ Improved	25%	0%
case-02	✓→✓	＝ Same ✓	4%	0%
case-04	✓→✓	＝ Same ✓	39%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

tencentblueking / bk-bcs

bcs-services/bcs-project-manager/.cursor/skills/nodejs-security-check/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

Node.js 安全审查

⚠️ 核心规则

永不信任用户输入 - 所有请求数据须 Schema 验证
安全默认 - 使用安全 API（execFile 而非 exec）
纵深防御 - 输入验证 + 参数化查询 + 输出编码

快速开始

bash
/nodejs-security-check                    # 智能扫描 src 目录
/nodejs-security-check file src/xxx.js    # 扫描指定文件
/nodejs-security-check report             # 生成详细报告

问题分级

| 前缀 | 含义 | 处理方式 | |------|------|----------| | 🔴 严重 | 可被直接利用 | 阻止发布 | | 🟡 中等 | 需特定条件 | 尽快修复 | | ⚪ 建议 | 最佳实践 | 可选优化 |

检查维度

| 维度 | 检查项 | |------|--------| | 输入验证 | Schema 验证、HPP 防护、请求体限制 | | 命令执行 | exec/spawn 注入、shell: true | | 文件操作 | 路径穿越、上传安全、ZipSlip | | 网络请求 | SSRF、私网阻断、DNS 重绑定 | | 数据库 | SQL 注入、NoSQL 注入、Mass Assignment | | 认证授权 | JWT 算法、会话安全、权限校验 |

📦 按需加载资源

| 资源 | URI | |-----|-----| | 完整检查清单 | skill://nodejs-security-check/references/checklist.md | | 修复示例 | skill://nodejs-security-check/references/fix-examples.md | | 评分标准 | skill://nodejs-security-check/references/scoring-standard.md |

📦 可用资源

skill://nodejs-security-check/references/checklist.md
skill://nodejs-security-check/references/fix-examples.md
skill://nodejs-security-check/references/report-format.md
skill://nodejs-security-check/references/scoring-standard.md
skill://nodejs-security-check/references/security-toolkit.md

> 根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载

Want to see if tencentblueking/Node.js 安全审查 would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.