據 AlphaMoat 統計,截至 2026-09,Node.js Security Audit 累計下載 1,847 次、獲 0 個星標,在全部 5,078 個 AI 技能中排名第 4,543 位,在「運維安全」分類(264 個)中排名第 255 位。

累計安裝

334

累計下載

1847

星標

全站排名

#4,543

全站前 90% · 「運維安全」前 97%

平台	累計安裝	累計下載	星標	評論
ClawHub ↗	45	1708	-	-
SkillHub ↗	334	1847	-	—

各平台的計數口徑不同,統計時間不一致。

這個技能是做什麼的

清單覆蓋秘密暴露、注入、XSS、認證、CORS、檔案路徑、回應標頭、限流、驗證和依賴。發現按嚴重度、檔案位置及修復建議報告。需檢查命令並保護原始碼和審計結果；清單及程式碼片段不能證明應用安全。

資料釋出於 2026-10-27

可以用來做什麼

發布前審查 Node.js 服務

什麼時候用

服務端改動需要聚焦安全清單時

示例提示詞

以下是根據技能文件生成的示例,不代表實際執行結果。

檢查服務，用證據、嚴重度和檔案位置報告問題。

月度資料趨勢

累計下載1847

星標-

2026-09 起統計方法調整:同名技能按作者分別統計,並覆蓋全部技能。圖中虛線為調整前的月份,與之後的資料不直接比較,也不計算跨越調整的增長。

月份	累計下載	環比	星標
2026-09	1847	—	-
2026-08	1569	+10.6%	-
2026-07	1418	+16.9%	-
2026-06	1213	+8.9%	-
2026-05	1114	—	-
2026-03	750	—	-

SKILL.md 原文

以下是作者釋出的原始檔案,按純文字顯示,本站未做修改或稽核;其中的連結不可點選,命令請核實後再執行。抓取於 2026-10-23。

2.9 KB · ClawHub v1.0.0

---
name: nodejs-security-audit
description: Audit Node.js HTTP servers and web apps for security vulnerabilities. Checks OWASP Top 10, CORS, auth bypass, XSS, path traversal, hardcoded secrets, missing headers, rate limiting, and input validation. Use when reviewing server code before deployment or after changes.
---

# Node.js Security Audit

Structured security audit for Node.js HTTP servers and web applications.

## Audit Checklist

展開全部(共 96 行)


### Critical (Must Fix Before Deploy)

**Hardcoded Secrets**
- Search for: API keys, passwords, tokens in source code
- Pattern: `grep -rn "password\|secret\|token\|apikey\|api_key" --include="*.js" --include="*.ts" | grep -v node_modules | grep -v "process.env\|\.env"`
- Fix: Move to env vars, fail if missing: `if (!process.env.SECRET) process.exit(1);`

**XSS in Dynamic Content**
- Search for: `innerHTML`, template literals injected into DOM, unsanitized user input in responses
- Fix: Use `textContent`, or escape: `str.replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":"&#39;"}[c]))`

**SQL/NoSQL Injection**
- Search for: String concatenation in queries, `eval()`, `Function()` with user input
- Fix: Parameterized queries, input validation

### High (Should Fix)

**CORS Misconfiguration**
- Search for: `Access-Control-Allow-Origin: *`
- Fix: Allowlist specific origins: `const origin = ALLOWED.has(req.headers.origin) ? req.headers.origin : ALLOWED.values().next().value`

**Auth Bypass**
- Check: Every route that should require auth actually checks it
- Common miss: Static file routes, agent/webhook endpoints, health checks that expose data

**Path Traversal**
- Check: `path.normalize()` + `startsWith(allowedDir)` on all file-serving routes
- Extra: Resolve symlinks with `fs.realpathSync()` and re-check

### Medium (Recommended)

**Security Headers**
```javascript
const HEADERS = {
  'X-Frame-Options': 'SAMEORIGIN',
  'X-Content-Type-Options': 'nosniff',
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
};
// Apply to all responses
```

**Rate Limiting**
```javascript
const attempts = new Map(); // ip -> { count, resetAt }
const LIMIT = 5, WINDOW = 60000;
function isLimited(ip) {
  const now = Date.now(), e = attempts.get(ip);
  if (!e || now > e.resetAt) { attempts.set(ip, {count:1, resetAt:now+WINDOW}); return false; }
  return ++e.count > LIMIT;
}
```

**Input Validation**
- Body size limits: `if (bodySize > 1048576) { req.destroy(); return; }`
- JSON parse in try/catch
- Type checking on expected fields

### Low (Consider)

**Dependency Audit:** `npm audit`
**Error Leakage:** Don't send stack traces to clients in production
**Cookie Security:** `HttpOnly; Secure; SameSite=Strict`

## Report Format

```
## Security Audit: [filename]

### Critical
1. **[Category]** Description — File:Line — Fix: ...

### High
...

### Medium
...

### Low
...

### Summary
X critical, X high, X medium, X low
```