security-and-hardening
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
Profile →npx skills add sickn33/agentic-awesome-skills --skill security-and-hardening --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
How it works
Imparts a threat-model-first approach: map trust boundaries, name assets, and run STRIDE per boundary. Requires enforcing input validation at boundaries, parameterized queries, output encoding, and secure session handling. Recommends steps such as:
- Validate external input at API routes/form handlers
- Parameterize all database queries
- Encode output to prevent XSS
- Use HTTPS for external communication
- Hash passwords with bcrypt/scrypt/argon2
- Set security headers and secure cookies
- Run npm audit before releases
- Apply OWASP Top 10 prevention patterns and concrete code examples for injections, broken authentication, XSS, access control, misconfigurations, sensitive data exposure, SSRF
- Use input validation schemas (e.g., zod) at route handlers
- Enforce safe file uploads with type/size checks
- Conduct threat-focused triage of npm audit findings
- Manage secrets via .env patterns and gitignore recommendations
- Secure AI/LLM interactions by isolating prompts, validating model outputs, and restricting tool permissions
- Provide a Security Review Checklist covering authentication, authorization, and input handling
When to use it
- Building anything that accepts user input
- Implementing authentication or authorization
- Storing or transmitting sensitive data
- Integrating with external APIs or services
- Adding file uploads, webhooks, or callbacks
- Handling payment or PII data
What it can touch
Declared tools: claude-code, codex, cursor. The skill outlines steps and code blocks that assume these tools may be used to model and implement secure patterns, with concrete examples for validation, credential handling, and secure communications.
Caveats
Describes limitations such as potential TOCTOU concerns in SSRF examples and the need for vigilant handling of model outputs in LLM contexts. License: MIT.
# Security and Hardening ## Overview Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems. ## When to Use - Building anything that accepts user input - Implementing authentication or authorization - Storing or transmitting sensitive data - Integrating with external APIs or services - Adding file uploads, webhooks, or callbacks - Handling payment or PII data ## Process: Threat Model First Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker: 1. **Map the trust boundaries.** Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and **LLM output**. Every boundary is attack surface. 2. **Name the assets.** What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement. 3. **Run STRIDE over each boundary** — a quick lens, not a ceremony: | Threat | Ask | Typical mitigation |
- Overview
- When to Use
- Process: Threat Model First
- The Three-Tier Boundary System
- Always Do (No Exceptions)
- Ask First (Requires Human Approval)
- Never Do
- OWASP Top 10 Prevention Patterns
- Injection (SQL, NoSQL, OS Command)
- Broken Authentication
- Cross-Site Scripting (XSS)
- Broken Access Control
- Security Misconfiguration
- Sensitive Data Exposure
Check for accidentally staged secrets git diff --cached | grep -i "password\|secret\|api_key\|token"
What does the security-and-hardening skill do?
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill security-and-hardening --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.