Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AratKruglik/claude-sdlc --skill nest-data-layergit clone --depth 1 https://github.com/AratKruglik/claude-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aratkruglik/claude-sdlc/nest-data-layer)<a href="https://agentmods.dev/skills/aratkruglik/claude-sdlc/nest-data-layer"><img src="https://agentmods.dev/badge/skills/aratkruglik/claude-sdlc/nest-data-layer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aratkruglik/claude-sdlc/nest-data-layer"><img src="https://agentmods.dev/badge/skills/aratkruglik/claude-sdlc/nest-data-layer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 165 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 168 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 171 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 268 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 269 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 270 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.02958 |
| Opus 5.5 | $0.00055 | $0.01183 |
| Sonnet 5.5 | $0.00027 | $0.00592 |
| Haiku 4.5 | $0.00014 | $0.00296 |
Grade A, and why
nest-data-layer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NestJS Data Layer
This skill consolidates ORM patterns for the three most common choices in NestJS projects: TypeORM, Prisma, Mongoose. Detect which is in use, then apply the matching section.
Detection
Marker (in dependencies) |
ORM |
|---|---|
@nestjs/typeorm + typeorm |
TypeORM |
@prisma/client + prisma |
Prisma |
@nestjs/mongoose + mongoose |
Mongoose |
| (multiple) | Hybrid project — match each feature's existing pattern |
| (none) | Raw driver (pg, mysql2) — flag in DECISIONS |
TypeORM
Module setup
// src/app.module.ts
@Module({
imports: [
TypeOrmModule.forRootAsync({
imports: [ConfigModule],
inject: [ConfigService],
useFactory: (config: ConfigService) => ({
type: 'postgres',
url: config.get<string>('DATABASE_URL'),
autoLoadEntities: true,
synchronize: false, // NEVER true in prod — use migrations
migrations: ['dist/migrations/*.js'],
migrationsRun: false,
logging: config.get<string>('NODE_ENV') !== 'production',
}),
}),
],
})
Entity
// src/users/entities/user.entity.ts
import { Entity, PrimaryGeneratedColumn, Column, CreateDateColumn, UpdateDateColumn, Index, OneToMany } from 'typeorm';
@Entity('users')
export class User {
@PrimaryGeneratedColumn('uuid')
id!: string;
@Index({ unique: true })
@Column({ length: 255 })
email!: string;
@Column({ select: false }) // hash never selected by default
passwordHash!: string;
@Column({ type: 'jsonb', default: {} })
metadata!: Record<string, unknown>;
@CreateDateColumn()
createdAt!: Date;
@UpdateDateColumn()
updatedAt!: Date;
@OneToMany(() => Order, (order) => order.user)
orders!: Order[];
}
select: falsefor sensitive columns (passwords, tokens) — must explicitly.addSelect('user.passwordHash').@Index({ unique: true })instead of@Column({ unique: true })for clarity at index level.- Use
relationsarray on find options (not eager: true) — eager loading is hard to opt out of later.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines 65ef22e28fb9
- 1mo ago First seen · 393 lines · 137 tokens per session scan A 8db2d1f46d07
nest-data-layer is a skill published in the GitHub repository AratKruglik/claude-sdlc (53 stars, last pushed 2d ago), licensed MIT. It adds 137 tokens to every session and 2,958 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dynamic
Fullstack development with bkend.ai BaaS — authentication, database, API integration. Triggers: fullstack, BaaS, login, signup, database, web app.
ring:mapping-service-resources
Mapping a Go service's Service -> Module -> Resource hierarchy for dispatch-layer registration: detects modules and per-module PostgreSQL/MongoDB/RabbitMQ resources, database names, and shared databases, generates MongoDB index migration pairs (.up.json/.down.json), detects existing Postgres migrations, emits an HTML…
fastapi-init-skill
A tool that creates a complete FastAPI web-service starting point, including database choices, login protection, file uploads, streaming responses, API documentation, and start or restart scripts.
nodejs-init-skill
A setup assistant for creating Node.js web services with the Express framework. It checks the environment, installs needed tools, and generates a ready-to-run project with authentication, file uploads, API documentation, and database choices.
mongodb-atlas-webhooks
Receive and verify MongoDB Atlas alert webhooks (Project Settings → Integrations → Webhook Settings). Use when setting up an Atlas alert webhook endpoint, verifying the X-MMS-Signature header (base64 HMAC-SHA1 of the raw body), debugging Atlas signature verification failures, or handling alerts such as…
mongodb-development
MongoDB development guidelines with Payload CMS, Mongoose, aggregation pipelines, and TypeScript best practices.