nodejs-best-practices

nodejs-best-practices is a skill for Claude Code from DDS-Solutions/AI-TadPole-OS. It costs 33 tokens per session (734 once invoked), scanned A, original, MIT.

A guide to designing Node.js applications with asynchronous code, suitable frameworks, security checks, and clear system structure. Node.js is a runtime for running JavaScript outside a web browser.

In plain words
What is it for?
Use it when building backend services, APIs, and other Node.js applications.
Why use it?
It helps avoid blocked servers, weak input handling, and architecture choices that do not fit the application.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Good fit Use it when building backend services, APIs, and other Node.js applications.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/dds-solutions/ai-tadpole-os/nodejs-best-practices
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add DDS-Solutions/AI-TadPole-OS --skill nodejs-best-practices
Clone the repo
git clone --depth 1 https://github.com/DDS-Solutions/AI-TadPole-OS

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for nodejs-best-practices

README.md
[![agentmods](https://agentmods.dev/badge/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices/github.svg)](https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices)
Your own site
<a href="https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices"><img src="https://agentmods.dev/badge/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for nodejs-best-practices

Your own site · 80×15
<a href="https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices"><img src="https://agentmods.dev/badge/skills/dds-solutions/ai-tadpole-os/nodejs-best-practices.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 734 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00033 $0.00734
Opus 5 $0.00016 $0.00367
Sonnet 5 $0.00007 $0.00147
Haiku 4.5 $0.00003 $0.00073

Measured 8d ago against content hash 7b0ed549c849, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

nodejs-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agent/skills/nodejs-best-practices/SKILL.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

[!IMPORTANT] AI Context & Knowledge Heritage

  • Subsystem: Agent Skills Registry / nodejs-best-practices
  • Architecture: @docs ARCHITECTURE:Documentation
  • Failure Path: Information drift, legacy terminology, or documentation mismatch.
  • Observability: Traceability via execution/parity_guard.py ([SKILL])

Node.js Best Practices

Philosophy: Asynchronous by default. Resilient to event-loop blocking. Strictly typed at boundaries. Core Principle: Think in streams and non-blocking concurrency; offload heavy compute.


🎯 Progressive Disclosure & L3 Reference Index

Read REQUIRED core rules below; consult deep L3 Reference Guides on demand:

L3 Reference Guide Purpose Trigger / When to Load
references/runtime_patterns.md Framework benchmarks (Hono/Fastify/Nest), Zod schemas, threadpools Framework selection & worker thread setup

1. Framework & Runtime Selection

What are you building?
├── Edge / Serverless / Modern REST ➔ Hono (Ultra-light, native TS)
├── High-Throughput Microservice    ➔ Fastify (Fast JSON schema serializer)
├── Enterprise Structured App        ➔ NestJS (Dependency injection, modular)
└── Full-stack Integration          ➔ Next.js Server Actions / tRPC

2. Layered Architecture Concept

Controller / Route  ➔ Validates request payload at the boundary (Zod/Valibot)
       │
       ▼
Service Layer       ➔ Encapsulates pure business logic (framework-agnostic)
       │
       ▼
Repository Layer    ➔ Performs database operations & external API I/O

3. Mandatory Concurrency & Security Rules

⚡ Event Loop Rules

  • No Sync I/O: Never call fs.readFileSync, fs.writeFileSync, or blocking crypto inside route handlers.
  • Streams for Large Payloads: Always stream large file uploads or JSON downloads (createReadStream()).
  • Parallel I/O: Use Promise.all() for independent queries; use Promise.allSettled() when partial failure is acceptable.

Read the full file on GitHub · 78 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 78 lines · 33 tokens per session scan A 7b0ed549c849

Subscribe to this mod's changes

nodejs-best-practices is a skill published in the GitHub repository DDS-Solutions/AI-TadPole-OS (8 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 734 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

nextjs-app-router

Full end-to-end tRPC setup for Next.js App Router. Covers route handler with fetchRequestHandler (GET + POST exports), TRPCProvider with QueryClientProvider, createTRPCOptionsProxy for RSC prefetching, HydrateClient/HydrationBoundary for hydration, useSuspenseQuery for Suspense, and server-side callers.

trpc/trpc · 74 tokens

nextjs-pages-router

Set up tRPC in Next.js Pages Router with createNextApiHandler, createTRPCNext, withTRPC HOC, SSR via ssr option and ssrPrepass, SSG via createServerSideHelpers with getStaticProps, and server-side helpers for getServerSideProps prefetching.

trpc/trpc · 67 tokens

openapi

Generate OpenAPI 3.1 spec from a tRPC router with @trpc/openapi CLI or programmatic API. Generate typed REST client with @hey-api/openapi-ts and configureTRPCHeyApiClient(). Configure transformers (superjson, EJSON) for generated clients. Alpha status.

trpc/trpc · 64 tokens

server-setup

Initialize tRPC with initTRPC.create(), define routers with t.router(), create procedures with .query()/.mutation()/.subscription(), configure context with createContext(), export AppRouter type, merge routers with t.mergeRouters(), lazy-load routers with lazy().

trpc/trpc · 56 tokens

subscriptions

Set up real-time event streams with async generator subscriptions using .subscription(async function() { yield }). SSE via httpSubscriptionLink is recommended over WebSocket. Use tracked(id, data) from @trpc/server for reconnection recovery with lastEventId. WebSocket via wsLink and createWSClient from @trpc/client…

trpc/trpc · 118 tokens

client-setup

Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.

trpc/trpc · 63 tokens