nodejs-express — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nodejs-express (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
require / module.exports). No ESM (except import() in gateway.js for MCP SDK).(req, res) => ... mounted via app.all() in server.js.// server.js — handlers object, then inline app.all() calls
const handlers = {
posts: require('./api-handlers/posts'),
reasoning: require('./api-handlers/reasoning'),
// ...
};
app.all('/api/posts', handlers.posts);
app.all('/api/posts/:id', handlers.posts);try/catch in every handler. Return structured JSON on error.async function handler(req, res) {
try {
// ...
res.json({ success: true, data });
} catch (err) {
res.status(500).json({ success: false, error: err.message });
}
}cors()express.json()globalLimit → 100 req/min, executeLimit → 10 req/min, mcpLimit → 60 req/min)_tip field into every JSON response)Every non-error JSON response auto-injects a _tip field:
res.json = function (body) {
if (body && typeof body === 'object' && !body._tip && !body.error) {
body._tip = 'Before solving, POST /api/reasoning/resolve...';
}
return original(body);
};.env for dev, .env.vps for productionDATABASE_URL, PORT, PGSSLMODE, NODE_ENVconst { rateLimitMiddleware } = require('./lib/rate-limit');
const globalLimit = rateLimitMiddleware('global', { maxRequests: 100, windowMs: 60000 });
app.use('/api/', globalLimit);process.on('SIGTERM', () => { closePool(); server.close(); });| Module | Purpose |
|---|---|
lib/db.js | PostgreSQL connection pool |
lib/rate-limit.js | In-memory sliding window rate limiter |
lib/reasoning-storage.js | Reasoning cache CRUD + resolve + failure-check |
lib/execution-history.js | Execution persistence + MCP usage logging |
lib/lifecycle-state-machine.js | Task lifecycle state transitions |
lib/validator.js | Task result validation (codegen sandbox) |
lib/canonical-models.js | Canonical schema builders |
lib/task-recovery.js | Stale claim recovery |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.