Nest.JS

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 1.0.0

Overview

This is a coherent NestJS guidance skill with some copy-paste safety cautions, but no hidden execution or deceptive behavior.

Install only if you want NestJS development guidance. Before applying examples, pin dependencies, avoid wildcard CORS in production, use development or test databases for sample connections and migrations, and keep secrets out of committed .env files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: database.md:53

Finding

Unpinned Package Retrieval and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: database.md, lines 53–57
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

bash

# Generate migration from entity changes
npx typeorm migration:generate -d src/data-source.ts src/migrations/AddUserTable
# Run migrations
npx typeorm migration:run -d src/data-source.ts

Technical Analysis

The documentation instructs users to invoke TypeORM through npx without specifying a reviewed version or requiring an existing project-local installation. If the executable is unavailable locally, npx may retrieve and execute a package from the configured package registry.

This behavior crosses a package-installation boundary at execution time. The effective code can differ from what was reviewed due to package updates, registry compromise, dependency confusion, or registry configuration changes. The migration command may also run with access to database configuration and application environment variables.

Attack Path

1. A user follows the documented migration command.
2. The expected TypeORM executable is absent from the local project dependencies.
3. npx resolves and downloads a package from the configured registry.
4. A compromised, substituted, or unexpectedly changed package executes under the user's account.
5. Malicious package or lifecycle code reads accessible files, environment variables, or database credentials.
6. Because the command is intended to run migrations, malicious code may connect to and modify the configured database.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npx. Accessible scope may include the project workspace, user-readable files, environment variables, package-registry credentials, and database credentials. If production database configuration is present, an attacker may be able to read, alter, or delete application data. The commands do not directly grant elevated oper ...[truncated 112 chars]

Remediation

View remediation

Remediation Suggestions

• Add a reviewed, explicitly pinned TypeORM version to the project's development dependencies.
• Commit and verify the package lockfile to ensure reproducible dependency resolution.
• Expose migration operations through package scripts that invoke the locked project-local binary.
• Where supported, use npx --no-install typeorm ... so execution fails instead of downloading an absent package.
• Use a trusted registry and enforce lockfile integrity in CI.
• Run migration generation and execution under a least-privileged account.
• Use database credentials limited to the permissions required for the migration environment.
• Review generated migrations before applying them, and never apply unreviewed migrations directly to production.
• A hardened example is:

json

{
  "devDependencies": {
    "typeorm": "REVIEWED_PINNED_VERSION"
  },
  "scripts": {
    "migration:generate": "typeorm migration:generate -d src/data-source.ts src/migrations/AddUserTable",
    "migration:run": "typeorm migration:run -d src/data-source.ts"
  }
}

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.md (reported line 11)May include surrounding context.

md

imports: [
    ConfigModule.forRoot({
      isGlobal: true,          // available everywhere without importing
      envFilePath: ['.env.local', '.env'], // first found wins per variable
      ignoreEnvFile: process.env.NODE_ENV === 'production', // use real env vars in prod
    }),
  ],

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.md (reported line 11)May include surrounding context.

md

imports: [
    ConfigModule.forRoot({
      isGlobal: true,          // available everywhere without importing
      envFilePath: ['.env.local', '.env'], // first found wins per variable
      ignoreEnvFile: process.env.NODE_ENV === 'production', // use real env vars in prod
    }),
  ],

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.md (reported line 119)May include surrounding context.

md

- Never commit `.env` with secrets — add to `.gitignore`
- Use `.env.example` with placeholder values for documentation
- In production, use real environment variables or a secrets manager (AWS SSM, Vault)
- `ConfigModule` with `ignoreEnvFile: true` in production — don't deploy .env files
- Validate required secrets at startup — fail fast, not on first request

### Async Configuration

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is broad enough to trigger on many general backend or Node.js API requests that are not clearly NestJS-specific, such as generic controllers, providers, decorators, or TypeScript-first API architecture. In an agent system, this can cause inappropriate skill invocation, leading the model to apply framework-specific guidance in the wrong context and potentially override more relevant or safer skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The WebSocket gateway example explicitly sets cors: { origin: '*' }, which permits any website to initiate browser-based cross-origin WebSocket connections. In a NestJS skill intended as production guidance, this is dangerous because readers may copy the configuration into real applications without understanding that it broadens the attack surface and can enable unauthorized cross-origin interaction when authentication or session cookies are present.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Prisma-specific guidance says to use onModuleDestroy instead of Prisma's built-in shutdown hook because it conflicts with Nest shutdown handling, while the later general guidance tells readers to enable enableShutdownHooks() in main.ts. These instructions can conflict for Prisma users and create intent-level ambiguity about the recommended shutdown approach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents code that would connect to a database at mongodb://localhost/nest, which can affect local data or system state if copied and run as-is. The surrounding documentation does not explicitly warn users that the example performs a real database connection or that they should verify the target environment before use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.