Borrowing it
Nothing to install: this file belongs to cohen-liel/hivemind. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cohen-liel/hivemind/main/.claude/skills/nodejs-express/SKILL.mdgit clone --depth 1 https://github.com/cohen-liel/hivemindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cohen-liel/hivemind/nodejs-express)<a href="https://agentmods.dev/skills/cohen-liel/hivemind/nodejs-express"><img src="https://agentmods.dev/badge/skills/cohen-liel/hivemind/nodejs-express/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cohen-liel/hivemind/nodejs-express"><img src="https://agentmods.dev/badge/skills/cohen-liel/hivemind/nodejs-express.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00847 |
| Opus 5.5 | $0.00014 | $0.00339 |
| Sonnet 5.5 | $0.00007 | $0.00169 |
| Haiku 4.5 | $0.00003 | $0.00085 |
Grade A, and why
nodejs-express scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Node.js + Express Patterns
Project Structure
src/
app.ts # Express app, middleware setup
server.ts # HTTP server, port binding
routes/ # Route definitions (auth.ts, users.ts)
controllers/ # Request handlers
services/ # Business logic
models/ # Prisma/Mongoose models
middleware/ # auth, error, validation
types/ # TypeScript interfaces
utils/ # Helpers
App Setup
// app.ts
import express from 'express'
import helmet from 'helmet'
import cors from 'cors'
import { errorHandler } from './middleware/error'
const app = express()
app.use(helmet())
app.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(','), credentials: true }))
app.use(express.json({ limit: '1mb' }))
app.use(express.urlencoded({ extended: true }))
app.use('/api/auth', authRouter)
app.use('/api/users', authenticate, usersRouter)
app.get('/health', (req, res) => res.json({ status: 'ok' }))
app.use(errorHandler) // Must be last
export default app
Controller Pattern (async error handling)
// Wrap async handlers to catch errors automatically
const asyncHandler = (fn: RequestHandler): RequestHandler =>
(req, res, next) => Promise.resolve(fn(req, res, next)).catch(next)
export const getUser = asyncHandler(async (req, res) => {
const user = await userService.findById(Number(req.params.id))
if (!user) return res.status(404).json({ error: 'User not found' })
res.json(user)
})
Auth Middleware
import jwt from 'jsonwebtoken'
export const authenticate: RequestHandler = (req, res, next) => {
const token = req.headers.authorization?.split(' ')[1]
if (!token) return res.status(401).json({ error: 'No token' })
try {
const payload = jwt.verify(token, process.env.JWT_SECRET!) as JwtPayload
req.user = payload
next()
} catch {
res.status(401).json({ error: 'Invalid token' })
}
}
Validation Middleware (Zod)
import { z } from 'zod'
const validate = (schema: z.ZodSchema) => (req: Request, res: Response, next: NextFunction) => {
const result = schema.safeParse(req.body)
if (!result.success) return res.status(400).json({ errors: result.error.flatten() })
req.body = result.data
next()
}
const CreateUserSchema = z.object({
email: z.string().email(),
password: z.string().min(8),
name: z.string().max(100)
})
router.post('/users', validate(CreateUserSchema), createUser)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 114 lines · 34 tokens per session scan A 0eb457ce01e1
nodejs-express is a skill published in the GitHub repository cohen-liel/hivemind (112 stars, last pushed 6mo ago), licensed Apache-2.0. It adds 34 tokens to every session and 847 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dotnet-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting pure .NET backend code for Kestrel-hosted services. It provides expert critique for REST endpoints, SignalR hubs, TypeScript/React client integration shape, pragmatic Rust interop, application services, AppHost-aware project…
python-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting Python backend code using Litestar or FastAPI with SQLAlchemy or Advanced Alchemy. Provides expert critique covering SOLID principles, hexagonal architecture, repository/service patterns, dependency injection, async correctness…
goframe-v2
GoFrame development skill. TRIGGER when writing/modifying Go files, implementing services, creating APIs, or database operations. DO NOT TRIGGER for frontend/shell scripts.
java-coding-standards
Java coding standards for Spring Boot services: naming, immutability, Optional usage, streams, exceptions, generics, and project layout.
go
Use when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog, project layout, table-driven tests, Go hardening. NOT language-agnostic threat modeling (that is secure-coding), NOT Dockerfile/CI shipping…
ring:migrating-to-lib-observability
Migrating a Lerian Go app off lib-commons observability imports (deprecated shims or removed APIs) to lib-observability via a fixed mapping table, then bumps go.mod and validates the build; ring:backend-go applies the edits. Covers log/zap/runtime/assert, opentelemetry/tracing, HTTP middleware, context helpers, and…