nestjs-expert

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, nestjs, security, testing, typescript, web.

What it does

Creates and configures NestJS modules, controllers, services, DTOs, guards, and interceptors for enterprise-grade TypeScript backend applications. Use when building NestJS REST APIs or GraphQL services, implementing dependency injection, scaffolding modular architecture, adding JWT/Passport authentication, integrating TypeORM or Prisma, or working with .module.ts, .controller.ts, and .service.ts files. Invoke for guards, interceptors, pipes, validation, Swagger documentation, and unit/E2E testing in NestJS projects.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill nestjs-expert

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/nestjs-expert ~/.claude/skills/nestjs-expert

Safety box score

Grade B, low risk: 12 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a NestJS implementation guide: it helps create and modify controllers, services, modules, DTOs, guards, tests, and auth wiring inside a TypeScript backend project. The main risks are bounded code execution during verification, and handling JWT/auth configuration that may touch environment secrets, but there are no shipped scripts or remote fetch/install steps.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The workflow explicitly tells the agent to run local project commands: `npm run lint`, `npm run test`, and `nest info`.
Network access	0 (none)	No shipped code downloads from the network or sends data to remote hosts; the files only cite documentation URLs and local reference paths.
Filesystem reach	1 (low)	The skill is meant to create and edit project files such as `.module.ts`, `.controller.ts`, `.service.ts`, `dto/.dto.ts`, and `.service.spec.ts`, but not paths outside the repo.
Secrets & credentials	1 (low)	The auth guidance uses secret-bearing configuration like `config.get('JWT_SECRET')` and `process.env.JWT_SECRET`, but it does not ask to expose or exfiltrate them.
Privilege & persistence	0 (none)	There is no sudo, service registration, shell-profile editing, or other privilege-changing behavior in the skill files.
Instruction hijack surface	0 (none)	I found no prompt-injection payloads, hidden text, or instructions to ignore higher-priority rules or hide actions from the user.
Irreversible actions	0 (none)	The skill generates backend code and tests, but it does not instruct the agent to deploy, publish, send messages, or make external side effects.
Transparency	0 (none)	All reviewed files are readable markdown; there are no binaries, obfuscated blobs, or unpinned installers.

Before installing

Confirm you’re okay with the agent running `npm run lint`, `npm run test`, and `nest info` in your repo.
If you’ll use the auth patterns, verify `JWT_SECRET` is stored in env/config and not hardcoded.
Check that generated files stay inside the NestJS project tree and won’t overwrite unrelated app code.

Rated 2026-10-19 by an automated review of 7 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/nestjs-expert/SKILL.md
Branch: main
Updated: 2026-09-19

php-pro — Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
running-release-tests — Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile.
django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages.
dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.