security-and-hardeningcommit d051d88SKILL.md · Hardening
Security and Hardening
Hardens web app code against vulnerabilities, starting from a threat model and covering input, auth, sessions, dependencies, privacy and LLM features.
npx skills add addyosmani/agent-skills --skill security-and-hardeningCommand selected. Copy it manually.
- Permissions
- read-repo
- write-files
- shell
- network
- Compatible with
- Claude Code, Codex, Cursor, Copilot, Gemini CLI
- GitHub
- 112.3k
- Source
- Community · Addy Osmani
- Status
- Scan passed
- License
- MIT
- Category
- Hardening
Core rule
Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory.
Execution Phases
Phase 01Threat model first
Map trust boundaries (including LLM output), name the assets, run STRIDE over each boundary, and write abuse cases as the first tests.
Phase 02Apply the three tiers
Always validate input, parameterize queries, encode output and use HTTPS; ask first before auth, PII or CORS changes; never commit secrets or log sensitive data.
Phase 03Implement controls
Use hardening-patterns.md for injection and XSS, access control, session cookies, headers and CORS, uploads, SSRF, rate limiting and secrets.
Phase 04Supply chain and privacy
Run the native audit against the committed lockfile and block dependency scripts; classify and minimize personal data with retention and deletion paths.
Phase 05Verify with checklist
Before sign-off, walk security-checklist.md and the verification checklist item by item.
Permissions (summarised from SKILL.md)
| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Writes or edits security-relevant code, configuration and files such as .env.example. |
| Command execution | Required | Runs the package manager's native audit and tests, and greps the staged diff for secrets before committing. |
| Network outbound | Limited | Only reaches the package registry when running dependency audits and signature checks. |
SKILL.md frontmatter (YAML)
---
name: security-and-hardening
description: Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions or session cookies, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
---