据 AlphaMoat 统计,截至 2026-09,Node.js Security Audit 累计下载 1,847 次、获 0 个星标,在全部 5,078 个 AI 技能中排名第 4,543 位,在「运维安全」分类(264 个)中排名第 255 位。

累计安装

334

累计下载

1,847

星标

全站排名

#4,543

全站前 90% · 「运维安全」前 97%

平台	累计安装	累计下载	星标	评论
ClawHub ↗	45	1,708	-	-
SkillHub ↗	334	1,847	-	—

各平台的计数口径不同,统计时间不一致。

这个技能是做什么的

清单覆盖秘密暴露、注入、XSS、认证、CORS、文件路径、响应头、限流、校验和依赖。发现按严重度、文件位置及修复建议报告。需检查命令并保护源码和审计结果；清单及代码片段不能证明应用安全。

资料发布于 2026-10-27

可以用来做什么

发布前审查 Node.js 服务

什么时候用

服务端改动需要聚焦安全清单时

示例提示词

以下是根据技能文档生成的示例,不代表实际运行结果。

检查服务，用证据、严重度和文件位置报告问题。

月度数据趋势

累计下载1,847

星标-

2026-09 起统计方法调整:同名技能按作者分别统计,并覆盖全部技能。图中虚线为调整前的月份,与之后的数据不直接比较,也不计算跨越调整的增长。

月份	累计下载	环比	星标
2026-09	1,847	—	-
2026-08	1,569	+10.6%	-
2026-07	1,418	+16.9%	-
2026-06	1,213	+8.9%	-
2026-05	1,114	—	-
2026-03	750	—	-

SKILL.md 原文

以下是作者发布的原始文件,按纯文本显示,本站未做修改或审核;其中的链接不可点击,命令请核实后再运行。抓取于 2026-10-23。

2.9 KB · ClawHub v1.0.0

---
name: nodejs-security-audit
description: Audit Node.js HTTP servers and web apps for security vulnerabilities. Checks OWASP Top 10, CORS, auth bypass, XSS, path traversal, hardcoded secrets, missing headers, rate limiting, and input validation. Use when reviewing server code before deployment or after changes.
---

# Node.js Security Audit

Structured security audit for Node.js HTTP servers and web applications.

## Audit Checklist

展开全部(共 96 行)


### Critical (Must Fix Before Deploy)

**Hardcoded Secrets**
- Search for: API keys, passwords, tokens in source code
- Pattern: `grep -rn "password\|secret\|token\|apikey\|api_key" --include="*.js" --include="*.ts" | grep -v node_modules | grep -v "process.env\|\.env"`
- Fix: Move to env vars, fail if missing: `if (!process.env.SECRET) process.exit(1);`

**XSS in Dynamic Content**
- Search for: `innerHTML`, template literals injected into DOM, unsanitized user input in responses
- Fix: Use `textContent`, or escape: `str.replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":"&#39;"}[c]))`

**SQL/NoSQL Injection**
- Search for: String concatenation in queries, `eval()`, `Function()` with user input
- Fix: Parameterized queries, input validation

### High (Should Fix)

**CORS Misconfiguration**
- Search for: `Access-Control-Allow-Origin: *`
- Fix: Allowlist specific origins: `const origin = ALLOWED.has(req.headers.origin) ? req.headers.origin : ALLOWED.values().next().value`

**Auth Bypass**
- Check: Every route that should require auth actually checks it
- Common miss: Static file routes, agent/webhook endpoints, health checks that expose data

**Path Traversal**
- Check: `path.normalize()` + `startsWith(allowedDir)` on all file-serving routes
- Extra: Resolve symlinks with `fs.realpathSync()` and re-check

### Medium (Recommended)

**Security Headers**
```javascript
const HEADERS = {
  'X-Frame-Options': 'SAMEORIGIN',
  'X-Content-Type-Options': 'nosniff',
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
};
// Apply to all responses
```

**Rate Limiting**
```javascript
const attempts = new Map(); // ip -> { count, resetAt }
const LIMIT = 5, WINDOW = 60000;
function isLimited(ip) {
  const now = Date.now(), e = attempts.get(ip);
  if (!e || now > e.resetAt) { attempts.set(ip, {count:1, resetAt:now+WINDOW}); return false; }
  return ++e.count > LIMIT;
}
```

**Input Validation**
- Body size limits: `if (bodySize > 1048576) { req.destroy(); return; }`
- JSON parse in try/catch
- Type checking on expected fields

### Low (Consider)

**Dependency Audit:** `npm audit`
**Error Leakage:** Don't send stack traces to clients in production
**Cookie Security:** `HttpOnly; Secure; SameSite=Strict`

## Report Format

```
## Security Audit: [filename]

### Critical
1. **[Category]** Description — File:Line — Fix: ...

### High
...

### Medium
...

### Low
...

### Summary
X critical, X high, X medium, X low
```