New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Nestjs Security

by HoangNguyen0403 in HoangNguyen0403/agent-skills-standard

Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS.

MITAuto-check: notesBackend & APIs

Install Nestjs Security

skills CLI
$ npx skills add HoangNguyen0403/agent-skills-standard --skill nestjs-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install HoangNguyen0403/agent-skills-standard nestjs-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/nestjs/nestjs-security .claude/skills/nestjs-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
nestjs-security
GitHub stars
572
Token cost
~778 tokens
SKILL.md length
271 words
Files
3 (incl. references)
Skills in repo
211
Repo updated
First seen
Licence
MIT

At a glance

Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS.

  • Works in 6 steps: Add Helmet — app.use(helmet()) in… → Configure JWT strategy — Use… → Bind global AuthGuard — Register as… → …
  • Adding auth strategies
  • SKILL.md covers Priority: P0 (CRITICAL), Workflow: Secure NestJS…, Global Auth Guard Example and Argon2id Hashing Example, plus 8 more sections
  • Calls npm

What it does

Nestjs Security is an agent skill from HoangNguyen0403/agent-skills-standard. Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS. Use when adding auth strategies, role-based access control, CSRF protection, or security headers.

Its SKILL.md is about 780 tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `evals/evals.json` and `references/implementation.md`).

It sits in Backend & APIs, covering Authorization and RBAC, Authentication and Web application vulnerabilities. It works with NestJS. The repository describes itself as: A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages. The licence is MIT.

When your agent uses it

  • Adding auth strategies
  • Role-based access control
  • CSRF protection
  • Security headers

Example prompts

  • “/nestjs-security”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

  1. Add Helmet — app.use(helmet()) in main.ts for HSTS, CSP headers.
  2. Configure JWT strategy — Use passport-jwt with RS256; validate iss and aud claims.
  3. Bind global AuthGuard — Register as APP_GUARD; use @Public() for open routes.
  4. Add throttling — Enable @nestjs/throttler with Redis store for rate limiting.
  5. Hash with Argon2id — Replace bcrypt with argon2.hash(password, { type: argon2.argon2id }).
  6. Verify — Run npm audit --prod and test that unauthenticated requests return 401.

What it can do on your machine

Read from SKILL.md and the folder at commit b529c2d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Nestjs Security loads about 778 tokens when it runs, and up to ~1.8k if it reads all its reference files. Until then it costs about 51 tokens; SKILL.md has 271 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~51
When it runs · the whole SKILL.md, loaded when a task matches
~778
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:73
    Secrets Manager / HashiCorp Vault), not `.env`.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from HoangNguyen0403/agent-skills-standard at commit b529c2d, republished under its MIT licence (© HoangNguyen0403). 271 words, ~778 tokens.

Download SKILL.mdSave it as .claude/skills/nestjs-security/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
nestjs-security
description
Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS. Use when adding auth strategies, role-based access control, CSRF protection, or security headers.

NestJS Security Standards

Priority: P0 (CRITICAL)

Workflow: Secure NestJS Application

  1. Add Helmet — app.use(helmet()) in main.ts for HSTS, CSP headers.
  2. Configure JWT strategy — Use passport-jwt with RS256; validate iss and aud claims.
  3. Bind global AuthGuard — Register as APP_GUARD; use @Public() for open routes.
  4. Add throttling — Enable @nestjs/throttler with Redis store for rate limiting.
  5. Hash with Argon2id — Replace bcrypt with argon2.hash(password, { type: argon2.argon2id }).
  6. Verify — Run npm audit --prod and test that unauthenticated requests return 401.

Global Auth Guard Example

See implementation examples

Argon2id Hashing Example

See implementation examples

Authentication (JWT)

  • Strategy: Use @nestjs/passport with passport-jwt.
  • Algorithm: Enforce RS256 (preferred) or HS256. Reject none.
  • Claims: Validate iss and aud.
  • Tokens: Short access (15m), Long httponly refresh (7d).
  • MFA: Require 2FA for admin panels.

Authorization (RBAC)

  • Deny by default: Bind AuthGuard globally (APP_GUARD).
  • Bypass: Create @Public() decorator for open routes.
  • Roles: Use Reflector.getAllAndOverride for Method/Class merge.

Cryptography

Hardening

  • Helmet: Mandatory. Enable HSTS, CSP.
  • CORS: Explicit origins only. No *.
  • Throttling: Use Redis-backed @nestjs/throttler in production.
  • CSRF: Required for cookie-based auth. See implementation.

Data Protection

  • Sanitization: Use ClassSerializerInterceptor + @Exclude().
  • Validation: ValidationPipe({ whitelist: true }) to prevent mass assignment.
  • Audit: Log mutations (Who, What, When). See implementation.

Secrets Management

  • CI/CD: Run npm audit --prod in pipelines.
  • Runtime: Inject via vault (AWS Secrets Manager / HashiCorp Vault), not .env.

Anti-Patterns

  • No Shadow APIs: Audit routes regularly; disable /docs in production.
  • No SSRF: Allowlist domains for all outgoing HTTP requests.
  • No SQLi: Use ORM; avoid raw query() with string concatenation.
  • No XSS: Sanitize HTML input with dompurify.

References

© HoangNguyen0403, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/nestjs/nestjs-security of HoangNguyen0403/agent-skills-standard.

  • SKILL.md
  • evals/evals.json
  • references/implementation.md

Open the folder on GitHubat commit b529c2d

Compare with similar skills

Nestjs Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Nestjs Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Nestjs Security this skillHoangNguyen0403/agent-skills-standard572—~778Automated safety check: NotesMIT
Supercheck Security Authsupercheck-io/supercheck215—~1.2kAutomated safety check: PassAGPL-3.0
API Auditbriiirussell/cybersecurity-skills413—~2.8kAutomated safety check: NotesMIT
Auth BypassNeoTheCapt/RedteamAgent143—~1.3kAutomated safety check: PassNone
Springboot Securityaffaan-m/ECC277k5 repos~2kAutomated safety check: PassMIT
API Security Designvinayaklatthe/microsoft-security-skills175—~2.2kAutomated safety check: PassMIT

Similar skills

  • Supercheck Security Auth

    supercheck-io/supercheck

    Work on Supercheck authentication, RBAC, tenant isolation, sessions, API and trigger keys, invitations, project membership, project variables, OAuth, super-admin behavior, SSRF, or…

    215 GitHub stars~1.2k tokensUpdated today
    Backend & APIsAuto-check passed

  • API Audit

    briiirussell/cybersecurity-skills

    Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023).

    413 GitHub stars~2.8k tokensUpdated 4 mo ago
    Backend & APIsAuto-check: notes

  • Auth Bypass

    NeoTheCapt/RedteamAgent

    Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses

    143 GitHub stars~1.3k tokensUpdated 2 mo ago
    Backend & APIsAuto-check passed

  • Springboot Security

    affaan-m/ECC

    Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

    277k GitHub starsUsed in 5 repos~2k tokens
    Backend & APIsAuto-check passed

  • API Security Design

    vinayaklatthe/microsoft-security-skills

    Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…

    175 GitHub stars~2.2k tokensUpdated 3 mo ago
    Backend & APIsAuto-check passed

  • Laravel Security

    affaan-m/ECC

    Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

    277k GitHub starsUsed in 3 repos~2k tokens
    Backend & APIsAuto-check passed

More from HoangNguyen0403/agent-skills-standard

All 211 skills in this repo

  • Subagent-Driven Development

    HoangNguyen0403/agent-skills-standard

    Runs a multi-task implementation plan by sending each task to a fresh implementer subagent, reviewing it independently, then reviewing the whole branch.

    572 GitHub stars~1.3k tokensUpdated yesterday
    Auto-check passed

  • draw.io Architecture Diagramming

    HoangNguyen0403/agent-skills-standard

    Draws architecture diagrams as editable draw.io files from a JSON spec, with a fixed house style, one C4 level per diagram and evidence-tagged shapes.

    572 GitHub stars~1.3k tokensUpdated yesterday
    Auto-check passed

  • Android Navigation 3 Guide

    HoangNguyen0403/agent-skills-standard

    Implements and migrates to Jetpack Navigation 3 in Compose: NavDisplay, typed route objects, a state-list back stack, deep links, multiple back stacks and dialog scenes.

    572 GitHub stars~687 tokensUpdated yesterday
    Auto-check passed

  • Angular HttpClient Standards

    HoangNguyen0403/agent-skills-standard

    Sets rules for Angular HTTP code: functional interceptors, typed requests, services that own every call, and httpResource for reactive data loading in Angular 17+.

    572 GitHub stars~652 tokensUpdated yesterday
    Auto-check passed

  • Angular Tooling

    HoangNguyen0403/agent-skills-standard

    Angular CLI usage, code generation, build configuration, and bundle optimization.

    572 GitHub stars~743 tokensUpdated yesterday
    Auto-check passed

  • Common Code Review

    HoangNguyen0403/agent-skills-standard

    Conduct high-quality, persona-driven code reviews. An agent skill from HoangNguyen0403/agent-skills-standard.

    572 GitHub stars~772 tokensUpdated yesterday
    Auto-check passed

Works with

Categories

Questions about Nestjs Security

What does Nestjs Security do?

Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS. Nestjs Security is an agent skill from HoangNguyen0403/agent-skills-standard. Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS.

When should I use Nestjs Security?

Nestjs Security fits situations like: adding auth strategies; role-based access control; CSRF protection; security headers.

How do I install Nestjs Security in Claude Code?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill nestjs-security -a claude-code`. Or copy the skill folder (skills/nestjs/nestjs-security in HoangNguyen0403/agent-skills-standard) into .claude/skills/nestjs-security in your project. Claude Code loads it when a task matches its description.

How do I install Nestjs Security in Codex?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill nestjs-security -a codex`. Or copy the skill folder (skills/nestjs/nestjs-security in HoangNguyen0403/agent-skills-standard) into .agents/skills/nestjs-security in your project. Codex loads it when a task matches its description.

Can I use Nestjs Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add HoangNguyen0403/agent-skills-standard --skill nestjs-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/nestjs-security, .gemini/skills/nestjs-security, .github/skills/nestjs-security and .opencode/skills/nestjs-security in your project.

What does Nestjs Security need to run?

Going by SKILL.md and its folder, Nestjs Security needs the command-line tools its instructions call (npm).

Does Nestjs Security access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Nestjs Security safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Nestjs Security use?

Nestjs Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Nestjs Security use?

About 778 tokens (SKILL.md is roughly 3.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 984 tokens, read only when the agent opens those files.

What are the alternatives to Nestjs Security?

Skills that share tags, products or a category with Nestjs Security: Supercheck Security Auth (supercheck-io/supercheck, 215 stars), API Audit (briiirussell/cybersecurity-skills, 413 stars), Auth Bypass (NeoTheCapt/RedteamAgent, 143 stars) and Springboot Security (affaan-m/ECC, 277k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Nestjs Security?

HoangNguyen0403 (a GitHub user) maintains it in HoangNguyen0403/agent-skills-standard, which has 572 GitHub stars. The repository holds 211 skills in this directory. The repository was last updated on October 9, 2026.

Source: HoangNguyen0403/agent-skills-standard on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.