express-api-developer
Facilitates Express.js backend API development with JWT authentication, RBAC, and ClickHouse integration for Vigil Guard.
Install this skill
Security score
The express-api-developer skill was audited on Feb 9, 2026 and we found 22 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 72 | fetch(`${BRANCH_SERVICES.A}/health`, { signal: AbortSignal.timeout(2000) }), |
Template literal with variable interpolation in command context
| 73 | fetch(`${BRANCH_SERVICES.B}/health`, { signal: AbortSignal.timeout(2000) }), |
Template literal with variable interpolation in command context
| 74 | fetch(`${BRANCH_SERVICES.C}/health`, { signal: AbortSignal.timeout(2000) }) |
Template literal with variable interpolation in command context
| 229 | const response = await fetch(`${BRANCH_SERVICES.A}/analyze`, { |
Template literal with variable interpolation in command context
| 237 | throw new Error(`Heuristics service error: ${response.status}`); |
Template literal with variable interpolation in command context
| 261 | const response = await fetch(`${BRANCH_SERVICES.B}/analyze`, { |
Template literal with variable interpolation in command context
| 269 | throw new Error(`Semantic service error: ${response.status}`); |
Template literal with variable interpolation in command context
| 376 | const query = `SELECT * FROM users WHERE username = '${username}'`; |
Curl to non-GitHub URL
| 467 | curl -X POST http://localhost:8787/api/auth/login \ |
Curl to non-GitHub URL
| 472 | curl http://localhost:8787/api/health/branches \ |
Curl to non-GitHub URL
| 476 | curl -X POST http://localhost:8787/api/analyze/heuristics \ |
Access to .env file
| 320 | origin: process.env.NODE_ENV === 'production' ? |
Access to .env file
| 321 | process.env.ALLOWED_ORIGINS.split(',') : |
Access to .env file
| 352 | const SECRET = process.env.JWT_SECRET; // 32+ chars from .env |
External URL reference
| 57 | A: 'http://heuristics-service:5005', // Heuristics (30% weight) |
External URL reference
| 58 | B: 'http://semantic-service:5006', // Semantic (35% weight) |
External URL reference
| 59 | C: 'http://prompt-guard-api:8000' // LLM Guard (35% weight) |
External URL reference
| 467 | curl -X POST http://localhost:8787/api/auth/login \ |
External URL reference
| 472 | curl http://localhost:8787/api/health/branches \ |
External URL reference
| 476 | curl -X POST http://localhost:8787/api/analyze/heuristics \ |
External URL reference
| 498 | - Express docs: https://expressjs.com/ |
External URL reference
| 499 | - ClickHouse docs: https://clickhouse.com/docs |