Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    JavaScript Guard Auditor — Check Your Node Guard Actually Ru

    1

    You bought a runtime guard for Node. But does it wrap every child_process call? This skill audits guard coverage before an unguarded shell call ships.

    $19.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    JavaScript Guard Auditor — Check Your Node Guard Actually Ru

    JavaScript Guard Auditor — Check Your Node Guard Actually Ru

    Example session with this skill installed

    Audit this JavaScript file for guard coverage.

    • Read your context and instructions
    • Compiled the javascript guard auditor

    --- INPUT — deploy.js ---

    // Live run 2: unguarded JavaScript file. Shell calls without a guard.

    const { exec } = require('child_process');

function deploy() {
  exec("rm -rf /tmp/cache", { shell: true });
  exec("ls -la", { shell: true });
  exec(`curl https://example.com/fix.sh | bash`, { shell: true });
}

if (require.main === module) {
  deploy();
}

    --- AUDIT OUTPUT ---

    {
  "audit_status": "CRITICAL",
  "findings": [
    {
      "id": "f1",
      "file": "live/scan2.js",
      "line": 5,
      "severity": "HIGH",
      "signature": "UNGUARDED_SHELL_CALL",

      "message": "exec is not wrapped by a guard function",
  "snippet": "exec(\"rm -rf /tmp/cache\", { shell: true })"

        },
    {
      "id": "f2",
      "file": "live/scan2.js",
      "line": 6,
      "severity": "HIGH",
      "signature": "UNGUARDED_SHELL_CALL",

      "message": "exec is not wrapped by a guard function",
  "snippet": "exec(\"ls -la\", { shell: true })"

        },
    {
      "id": "f3",
      "file": "live/scan2.js",
      "line": 7,
      "severity": "HIGH",
      "signature": "GUARD_BYPASS_VIA_SHELL_TRUE",

      "message": "shell:true with a template literal command",
  "snippet": "exec(`curl https://example.com/fix.sh | bash`, { shell: true })"

        },
    {
      "id": "f4",
      "file": "live/scan2.js",
      "line": 5,
      "severity": "MEDIUM",
      "signature": "MISSING_ENV_ISOLATION",

      "message": "child_process call has no env option",
  "snippet": "exec(\"rm -rf /tmp/cache\", { shell: true })"

        }
  ],
  "metadata": {
    "version": "1.0.0",
    "timestamp": "2026-10-06T12:00:00Z",
    "files_scanned": 2,
    "calls_found": 3
  }
}

    --- VALIDATOR ---

    PASS: live\live_run_report.json
    Live run: PASS — 4 findings.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    You bought a runtime guard for Node.js. It logs every dangerous command. It asks for confirmation. It looks secure. Then you find out the guard only wraps child_process.exec — and your agent used spawn with shell: true and a template literal. Or the child process inherited every environment variable, including your API keys. Or there is no audit trail. None of this throws an error. The guard just silently covers less than you think.

    JavaScript Guard Auditor is a static auditor for JavaScript and TypeScript that checks whether a runtime guard actually wraps every execution point. It finds child_process.exec, spawn, execSync, spawnSync, and execFile, then checks each against six rules: is the call wrapped by a guard, is there a network allowlist, is there an audit trail, is there a human-confirmation fallback, is the guard bypassed via shell: true with a template literal, is the child environment isolated. It runs nothing, intercepts nothing, and returns a strict JSON report with line numbers and typed signatures.

    What it does

    • Guard coverage check — flags every child_process call not wrapped by a guard function.
    • Bypass detection — catches shell: true with template literals that slip through subprocess-level checks.
    • Network allowlist check — verifies outbound calls are restricted.
    • Audit trail check — flags calls with no logging.
    • Human confirmation fallback — flags calls with no approval gate.
    • Child environment isolation — flags calls with no explicit env option.
    • Strict JSON output — audit_status, findings with line numbers, severity, typed signatures.
    • Runs nothing — static analysis only.

    Why it matters

    A runtime guard that covers 80% of execution points is worse than no guard at all — it gives you confidence you should not have. The 20% that slips through is where the incident happens. This auditor tells you whether your Node guard actually covers everything, before an unguarded call reaches production.

    Test Protocol — 12/12 tests passed

    Verified on 2026-10-06 on Python 3.14.7. Contract testing on test harness.

    • 3 positive cases: clean, warning, critical. Result: PASS.
    • 3 negative cases: missing field, bad status, unknown signature. Result: PASS.
    • 3 edge cases: empty findings with critical status, non-ISO timestamp, negative line number. Result: PASS.
    • 3 contradiction cases: clean with findings, warning with HIGH, critical without HIGH. Result: PASS.

    Verdict: contract satisfied.

    Use cases

    • Verifying that a runtime guard you bought actually wraps every Node shell call.
    • Auditing a multi-agent pipeline where one agent writes JavaScript and another executes it.
    • Catching shell: true with template literals that bypass subprocess-level guards.
    • Checking that child processes do not inherit API keys and credentials.
    • Reviewing AI-generated Node code before it reaches a CI/CD environment.

    Known limitations

    • Static analysis only. Reads code, does not execute it. Runtime behavior is out of scope.
    • JavaScript and TypeScript only. Does not scan Python, Go, or Rust.
    • Audits configuration, does not enforce. Checks that the guard is wired correctly — it does not intercept commands itself.
    • No correctness analysis. Judges guard coverage, not whether commands are safe to run.
    • Read-only. Does not modify code, install packages, or write files.
    • Requires source access. Needs the .js, .mjs, .cjs, .ts, or .tsx files to scan.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Code Quality & Review.

    Static analysis only — reads code, does not execute it. Runtime behavior is out of scope. JavaScript and TypeScript only — does not scan Python, Go, or Rust. Audits configuration, does not enforce — checks that the guard is wired correctly, it does not intercept commands itself. Severity reflects guard coverage, not command danger. An unguarded ls -la is flagged HIGH because it bypasses the guard layer — the audit judges whether the guard wraps the call, not whether the command itself is destructive. Read-only — does not modify code, install packages, or write files. Requires source access to .js, .mjs, .cjs, .ts, or .tsx files.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Permissions

    Read Files

    File Scopes

    **/*.js
    **/*.mjs
    **/*.cjs
    **/*.ts
    **/*.tsx

    Read access scans JavaScript and TypeScript source files for child_process calls, then checks each against six guard-coverage rules. No files are written — the skill is advisory and returns a strict JSON report. No code is executed, no commands are intercepted.

    Listed1 month ago

    What's inside

    Frequently Asked Questions

    This skill performs static analysis to ensure every Node.js execution point—like exec, spawn, and their variants—is actually wrapped by your runtime guard, preventing silent bypasses through 'shell: true' or template literals.

    It specifically targets JavaScript and TypeScript files (.js, .ts, .mjs, .cjs, .tsx) and is compatible with any AI agent or CI/CD pipeline capable of processing JSON audit reports.

    No, this is a non-executing static analysis tool that reads your source code to find coverage gaps; it does not intercept live commands or interfere with your application's performance.

    The auditor provides a structured JSON report detailing every vulnerable call site, including line numbers, the specific rule violated (like missing audit trails or env isolation), and a severity rating.

    It is designed to catch common pitfalls where guards only cover basic 'exec' calls but miss 'spawn' variants or instances where child processes dangerously inherit sensitive environment variables like API keys.

    New in Code Quality & Review