# Security and Hardening (security-and-hardening)

> Hardens web app code against vulnerabilities, starting from a threat model and covering input, auth, sessions, dependencies, privacy and LLM features.

- Category: [Hardening](https://www.myskills.tools/en/categories/hardening/)
- Source: Community · Addy Osmani
- Repository: https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening (commit d051d88)
- SKILL.md: https://github.com/addyosmani/agent-skills/blob/main/skills/security-and-hardening/SKILL.md
- Install command: `npx skills add addyosmani/agent-skills --skill security-and-hardening`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor, Copilot, Gemini CLI
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory.

## Execution Phases

1. **Threat model first** — Map trust boundaries (including LLM output), name the assets, run STRIDE over each boundary, and write abuse cases as the first tests.
2. **Apply the three tiers** — Always validate input, parameterize queries, encode output and use HTTPS; ask first before auth, PII or CORS changes; never commit secrets or log sensitive data.
3. **Implement controls** — Use hardening-patterns.md for injection and XSS, access control, session cookies, headers and CORS, uploads, SSRF, rate limiting and secrets.
4. **Supply chain and privacy** — Run the native audit against the committed lockfile and block dependency scripts; classify and minimize personal data with retention and deletion paths.
5. **Verify with checklist** — Before sign-off, walk security-checklist.md and the verification checklist item by item.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Writes or edits security-relevant code, configuration and files such as .env.example. |
| Command execution | Required | Runs the package manager's native audit and tests, and greps the staged diff for secrets before committing. |
| Network outbound | Limited | Only reaches the package registry when running dependency audits and signature checks. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: security-and-hardening
description: Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions or session cookies, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/security-and-hardening/