Identify authentication, validation, and module boundary weaknesses in NestJS applications.
npx skills add https://github.com/xalgord/xalgorix --skill nestjs-xalgord
Please help me install this Agent Skill. Skill: nestjs Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/frameworks/nestjs Command: npx skills add https://github.com/xalgord/xalgorix --skill nestjs-xalgord
This playbook helps security engineers and auditors find authentication, validation, and module boundary weaknesses in NestJS applications that lead to unauthorized access, data leakage, and logic bypasses.
Use the nestjs playbook to enumerate Swagger, map guards and pipes, and run cross-transport tests to identify guard and validation bypasses.
High-intent search queries and answers about installing and using this skill.
To find NestJS vulnerabilities, audit global, controller, and method-level guards for metadata mismatches and @Public misuse, then test ValidationPipe and nested DTO misconfigurations for payload coercion bypasses to expose unauthorized access paths.
Cross-transport testing verifies identical business logic across HTTP, WebSocket, GraphQL, and microservice transports to reveal transport-specific security gaps and guard bypasses unique to each protocol handler.
Test for ORM injection and serialization leaks in NestJS by probing database query construction and serialization responses to detect cache/key poisoning and expose sensitive fields hidden in DTOs.
Yes, you can integrate NestJS security testing into CI pipelines by running automated guard and validation test matrices, cross-transport probes, and ORM injection checks to identify module boundary weaknesses during builds.
The best way to audit NestJS guard stacks is to enumerate Swagger documentation to map endpoints, then systematically fuzz validation on controllers and microservice handlers to produce reproducible security findings.
NestJS ValidationPipe allows payload type coercion bypasses when Parse/Transform pipes and nested DTOs are misconfigured, failing to enforce strict type checking and permitting unauthorized data manipulation.
genesis-agentsDesign and implement RESTful APIs with NestJS controllers, services, and DTOs.
EntroVyxProvide offensive security payloads and bypass techniques for manual penetration testing.
giosuetedeschi-specFuzz REST, SOAP, and GraphQL APIs to detect IDOR, injection, and authentication bypasses.
pacphiIdentify and validate security vulnerabilities in software applications.
