Open-Verifik/backend-agent-runbook
.cursor/skills/backend-agent-runbook/SKILL.md
Run, configure, and verify the Zelf backend API. Use when working on backend setup, local execution, tests, Mongo requirements, route verification, or docs-related backend workflows.
development
Updated Apr 17, 2026
$ install --global
skillsauthnpx skillsauth add Open-Verifik/zelf-online-version backend-agent-runbookInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 3:05 AM92.3s1 file scanned
SKILL.md
- name:
- backend-agent-runbook
- description:
- Run, configure, and verify the Zelf backend API. Use when working on backend setup, local execution, tests, Mongo requirements, route verification, or docs-related backend workflows.
Backend Agent Runbook
Use this skill for practical backend operations in zelf.
Quick start
- Install dependencies with
npm install. - Copy
.env.exampleto.envand provide at leastMONGODB_URI, secrets, and any service keys needed for your area. - Start MongoDB locally.
- Start the API with
npm start.
Port guidance
Core/config.jsfalls back to3000..env.examplesetsPORT=3003.- Several older tests still default to
3000or3050. - Prefer an explicit
PORTwhenever you run the API or tests so the server and test client agree.
Recommended default local workflow:
PORT=3003 npm start
For a test file that expects another port, export that same PORT before starting the server and running the test.
Core commands
- Dev server:
npm start - Unit tests:
npm run test:unit - Integration tests:
npm run test:integration - End-to-end tests:
npm run test:e2e - Focused integration checks:
npm run test:lease,npm run test:search-tag,npm run test:authentication - Ops scripts:
npm run audit:ipfs-pay-balances,npm run repair:blockdag-nft-index,npm run deploy:checkout-avax
Test requirements
- Use Node
24and local MongoDB, followingtests/README.md. - The backend follows a strict no-mocking policy.
- Integration tests hit a live server, usually create a session via
/api/sessions, then call protected routes withAuthorization: Bearer <token>andOrigin: https://test.example.com. - The dedicated test database is
zelf_testing.
By area
General API work
server.jscontrols startup order, JWT handling, and protected vs unprotected route mounting.- Route registration lives in
Routes/unprotected-repositories.jsandRoutes/protected-repositories.js.
Tags, search, and lease flows
- Check
Repositories/Tags/plus related integration tests undertests/integration/. - Use
config/0012589021.jsonwhen a biometric payload is required in tests.
BlockDAG and NFT flows
- Check
Repositories/BlockDAG/, especially the public/protected route split and the smart-contract folder underRepositories/BlockDAG/smart-contracts/. - Relevant maintenance scripts include
npm run repair:blockdag-nft-index.
Docs work
- Public API docs belong in
zelf-documentation/docs/api/. - Public examples must use
https://api.zelf.world, not localhost.
Maintenance
- When commands, ports, or environment expectations change, update this file and mirror durable high-signal facts in
AGENTS.md.
Related Skills
Open-Verifik/add-repository-feature
development
VerifiedTrustedCommunity
Scaffold and integrate a new Zelf backend repository feature. Use when adding a new `Repositories/<Feature>/` area, using the repository generator, or wiring a new backend module into the Koa route registries.
SKILL.mdUpdated Apr 16, 2026
openclaw/openclaw-secret-scanning-maintainer
development
VerifiedTrustedCommunity
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
357,764SKILL.mdUpdated Apr 15, 2026
openclaw/openclaw-release-maintainer
development
VerifiedTrustedCommunity
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/openclaw-qa-testing
development
VerifiedTrustedCommunity
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
357,764SKILL.mdUpdated Apr 10, 2026