Node.js Project Architecture

Node.js project architecture standards for AI-assisted development. Enforces file splitting (<400 lines), config externalization, route modularization, and a...

This is a coherent, instruction-only architecture guide — it won't itself install code or ask for credentials. However, follow-up considerations before adopting its patterns: - Review any produced admin endpoint code carefully. Ensure requireAdmin is implemented with robust authentication (not a plain header in production), use TLS, enforce rate limits, CSRF protection, and logging. - Avoid storing sensitive secrets (admin passwords, API secrets) in a web-served config.json; prefer environment variables or a secrets manager for production. If you must use config files, ensure /api/config never returns secret fields and that backup files are protected. - Validate and sanitize incoming admin POST data before writing config.json, and consider access controls (IP allowlist, OAuth, or token-based auth) rather than a simple header password. - Treat hot-reload in production cautiously: it simplifies operations but can enable misconfiguration or privilege escalation if exposed publicly. - Because the skill is instruction-only, the security risk comes from code you or an agent generate from these instructions — audit generated server/admin code before deploying publicly.

Type: OpenClaw Skill Name: nodejs-project-arch Version: 1.1.0 The skill bundle provides architectural standards for Node.js projects aimed at optimizing AI context usage, but it explicitly instructs the AI to implement a high-risk administrative 'hot-reload' feature. This feature includes code patterns in SKILL.md and docs/Config-Pattern.md that perform direct, unsanitized filesystem writes (fs.writeFileSync) to a configuration file using user-supplied data (req.body). While the intent appears to be developer convenience, this pattern introduces a significant security vulnerability (Arbitrary File Write/Configuration Injection) and promotes a weak authentication mechanism (x-admin-password header) for sensitive administrative actions.