skills/ HoangNguyen0403/agent-skills-standard

nestjs-security-isolation

Enforce multi-tenant isolation and PostgreSQL Row Level Security in NestJS. Use when enforcing tenant isolation or PostgreSQL RLS in NestJS multi-tenant apps.

0
Installs
—
Rating
—
Success rate
5
Files scanned
Scan passedbackend
Source on GitHub

Security scan

Scan passed

No risky patterns were found in the scanned files.

5 files scannedscanner v1.2.0Oct 11, 2026

Content sha256 638db34c4723b04e… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

SKILL.md

exact scanned copy

Priority: P0 (CRITICAL)

Strict multi-tenant isolation. All child-centric data must secured via PostgreSQL RLS and service-level validation.

RLS Enforcement Workflow

  1. Migration: Create tables with ENABLE ROW LEVEL SECURITY. Define policies using current_setting('app.current_user_id').
  2. Entity Logic: Add @Security JSDoc to entity class.
  3. Security Doc: Update SECURITY.md with new table and its access logic.
  4. Service Validation: Call childrenService.validateChildAccess(childId, userId) before any persistence operation.

Core Guidelines

  1. Mandatory RLS: Every new table linking to child or family MUST RLS enabled in its creation migration.
  2. Centralized Validation: Never reimplement access logic. Use ChildrenService for child/family membership checks.
  3. Traceable Security: SECURITY.md source of truth. Any change to RLS policies must reflected there immediately.
  4. Nested Route Constraint: Data isolation enforced at controller level via nested routes: /children/:childId/....
  5. No Direct Entity exposure: Use Response DTOs to prevent leaking internal database IDs or metadata that could circumvent security checks.

Anti-Patterns

  • No Public Tables: Don't create child-linked tables without RLS.
  • No Manual Policy Checks: Don't write raw SQL access checks in services. Use centralized validator.
  • No Stale Docs: Don't merge RLS changes without updating SECURITY.md and entity JSDoc.
  • No Root IDs: Don't use /domain/:id for child data. Always scope by :childId.

References

Files

5
7.4 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from HoangNguyen0403/agent-skills-standard8

android-agp-upgrade

Upgrade an Android project to Android Gradle Plugin (AGP) 9. Use when migrating to AGP 9, updating Gradle build files, migrating to built-in Kotlin, or adopting the new AGP DSL.

Scan passed 0
android-architecture

Apply Clean Architecture layering, modularization, and Unidirectional Data Flow in Android projects. Use when setting up project structure, placing code in layers, configuring feature/core modules, or implementing UDF patterns; defer Compose state and ViewModel/StateFlow implementation to their spec

Scan passed 0
android-background-work

Implement WorkManager and background processing correctly on Android. Use when creating Worker classes, scheduling tasks, choosing between WorkManager and Foreground Services, or setting up Hilt in workers; defer FCM and notification delivery to android-notifications.

Scan passed 0
android-compose

Build high-performance declarative UI with Jetpack Compose. Use when writing Composable functions, optimizing recomposition, hoisting state, or working with LazyColumn and side effects; defer deep-link and navigation routing to android-navigation.

Scan passed 0
android-compose-migration

Migrate an Android XML View to Jetpack Compose following a structured 10-step workflow. Use when converting XML layouts to Compose, setting up Compose in an existing View-based project, or incrementally adopting Compose.

Scan passed 0
android-concurrency

Write correct coroutine scopes, lifecycle collection, and dispatcher injection in Android production code. Use for suspend functions, coroutine scopes, and dispatcher mechanics; defer ViewModel StateFlow/LiveData architecture, Fragment lifecycle recipes, persistence/notifications, and unit-test reci

Scan passed 0
android-deployment

Configure release signing, R8 obfuscation, and App Bundle publishing for Android. Use when setting up signing configs, enabling minification, adding ProGuard keep rules, or preparing for Play Store submission.

Scan passed 0
android-design-system

Enforce Material Design 3 theming and design token usage in Jetpack Compose. Use when implementing M3 components, color schemes, typography, or design tokens.

Scan passed 0

Related backend skillsscan passed

integration-fastapi

PostHog integration for FastAPI applications

Scan passed 0
java-coding-standards

Java coding standards for Spring Boot and Quarkus services: naming, immutability, Optional usage, streams, exceptions, generics, CDI, reactive patterns, and project layout. Automatically applies framework-specific conventions. Use when writing or reviewing Java in a Spring Boot or Quarkus service.

Scan passed 0
qa-only

Report browser/API/CLI/job/worker/webhook bugs. (gstack)

Scan passed 0
build-mcp-server

This skill should be used when the user asks to "build an MCP server", "create an MCP", "make an MCP integration", "wrap an API for Claude", "expose tools to Claude", "make an MCP app", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development

Scan passed 0
stripe-directory

Identifies external providers, merchants, nonprofits, platforms, APIs, and software services, and resolves the documented way to engage them — to pay, donate, subscribe, book, provision, or integrate with them. MUST be used BEFORE web search, model memory, or any other directory/vendor-lookup skill

Scan passed 0
middlewares

Create and compose tRPC middleware with t.procedure.use(), extend context via opts.next({ ctx }), build reusable middleware with .concat() and .unstable_pipe(), define base procedures like publicProcedure and authedProcedure. Access raw input with getRawInput(). Logging, timing, OTEL tracing pattern

Scan passed 0