Fähigkeiten security-and-hardening
📦
security-and-hardening
Inhaltsrevision r2 Sicher ⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen
Harden Applications Against Security Risks
Security reviews can miss trust boundaries and unsafe data flows. This skill supplies threat-modeling prompts, OWASP patterns, and practical review checklists.
Unterstützt: Claude Codex Code(CC)
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "security-and-hardening" from https://skillstore.io/skills/addyosmani-security-and-hardening.md and its manifest at https://skillstore.io/api/skills/addyosmani-security-and-hardening/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„security-and-hardening“ wird verwendet. Review an endpoint that accepts a webhook URL and fetches it on behalf of a user.
Erwartetes Ergebnis:
- Risk: The server may be vulnerable to SSRF if it fetches arbitrary user-supplied URLs.
- Control: Allowlist HTTPS hosts, resolve all addresses, reject private or reserved ranges, and disable redirects.
- Verification: Test loopback, link-local, private IPv4, IPv6, redirect, and DNS-rebinding cases.
„security-and-hardening“ wird verwendet. Assess an LLM feature that renders model replies in a web page.
Erwartetes Ergebnis:
- Risk: Model output is untrusted and may become stored XSS when inserted as HTML.
- Control: Encode output as text by default, or sanitize approved markup before rendering.
- Verification: Test script payloads, event handlers, malformed markup, and content from retrieved documents.
„security-and-hardening“ wird verwendet. Triage a high-severity package advisory from a native package-manager audit.
Erwartetes Ergebnis:
- Decision: Confirm whether the vulnerable function is reachable in production, build, test, or deployment paths.
- Action: Update to a patched version when available, review the lockfile diff, and test the resulting dependency graph.
- Exception: Document a temporary deferral, mitigation, owner, and review date when the vulnerable path is confirmed unused.
Sicherheitsaudit
Sicherv2 • 19.9.2026 Versionsbericht öffnen
All 96 findings are false positives from examples and Markdown in SKILL.md. No executable behavior or prompt injection was found.
1
Gescannte Dateien
525
Analysierte Zeilen
0
Prüfelemente
0
Falschmeldungen ignoriert
Risikofaktoren
⚡ Enthält Skripte (3)
⚙️ Externe Befehle (50)
SKILL.md:71 SKILL.md:77 SKILL.md:81-83 SKILL.md:83-90 SKILL.md:90-94 SKILL.md:94-114 SKILL.md:114-118 SKILL.md:118-128 SKILL.md:128-132 SKILL.md:132-148 SKILL.md:148-152 SKILL.md:152-173 SKILL.md:173-177 SKILL.md:177-187 SKILL.md:187-191 SKILL.md:191-193 SKILL.md:193-216 SKILL.md:216-218 SKILL.md:218 SKILL.md:220 SKILL.md:226-252 SKILL.md:252-256 SKILL.md:256-270 SKILL.md:270-276 SKILL.md:276-284 SKILL.md:284-298 SKILL.md:298-311 SKILL.md:311 SKILL.md:316-317 SKILL.md:317 SKILL.md:318 SKILL.md:322-338 SKILL.md:338-340 SKILL.md:340 SKILL.md:342-350 SKILL.md:350-352 SKILL.md:352-356 SKILL.md:356-368 SKILL.md:368-371 SKILL.md:371-374 SKILL.md:374-391 SKILL.md:391-397 SKILL.md:397-403 SKILL.md:403 SKILL.md:410-412 SKILL.md:412-425 SKILL.md:425-429 SKILL.md:429-471 SKILL.md:471-474 SKILL.md:474-498
🌐 Netzwerkzugriff (6)
📁 Dateisystemzugriff (4)
🔑 Umgebungsvariablen (9)
Das letzte abgeschlossene statische und semantische Audit erkannte keine bestätigten Sicherheitsbefunde. Dies beweist nicht, dass der Skill keine Nebenwirkungen hat.
Geprüft von: codex Audit-Verlauf anzeigen →
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-security-and-hardening/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/addyosmani-security-and-hardening.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
addyosmani. (2026). security-and-hardening security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2BibTeX-Zitat
@techreport{addyosmani-addyosmani-security-and-hardening-2026,
author = {addyosmani},
title = {security-and-hardening security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-and-hardening security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "addyosmani"
date-released: "2026-09-19"
url: "https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2"
identifiers:
- type: other
value: "skillstore:addyosmani-security-and-hardening:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
87
Spezifikationskonformität
Was Sie erstellen können
Review a New API Endpoint
Map trust boundaries, validate request data, check authorization, and identify abuse cases before shipping an endpoint.
Assess a Dependency Update
Triage audit results by reachability, review install scripts and provenance, and define a documented remediation decision.
Secure an AI Feature
Evaluate prompt injection, unsafe model output, excessive tool permissions, data exposure, and unbounded consumption risks.
Diese Prompts ausprobieren
Basic Security Review
Review this feature for trust boundaries, untrusted inputs, authentication, authorization, and sensitive data exposure. List the three most important fixes.
OWASP Endpoint Review
Audit this API endpoint against relevant OWASP risks. Check validation, queries, output encoding, access control, rate limits, errors, and logging. Cite issues and propose fixes.
Dependency Risk Triage
Triage these package audit results. Check reachability, available fixes, install scripts, provenance, and lockfile impact. Recommend an action and review date.
AI System Threat Model
Threat-model this LLM feature. Analyze prompt injection, unsafe output, data exposure, tool permissions, retrieval isolation, SSRF, limits, and irreversible actions. Prioritize controls and tests.
Bewährte Praktiken
- Start with assets, trust boundaries, abuse cases, and authorization assumptions before choosing controls.
- Treat user input, external responses, files, environment values, and model output as untrusted until validated.
- Pair every recommendation with an implementation check, a negative test, and an owner for follow-up.
Vermeiden
- Do not treat a prompt, client-side check, framework default, or internal network as a complete security boundary.
- Do not pass untrusted data into SQL, shells, eval, HTML, file paths, or privileged tools without strict validation.
- Do not accept audit results, dependency signatures, or compliance claims as proof without checking reachability and context.
Häufig gestellte Fragen
Does this skill scan my repository?
No. It provides review guidance and checklists. Use dedicated scanners and human review to inspect repository and runtime behavior.
Which security topics does it cover?
It covers threat modeling, OWASP risks, authentication, authorization, input validation, XSS, SSRF, files, secrets, privacy, dependencies, and LLM features.
Can it replace a penetration test?
No. It supports design and code review but cannot replace penetration testing, configuration review, monitoring, or incident exercises.
How should I use its code examples?
Treat examples as patterns to adapt. Confirm framework behavior, error handling, permissions, deployment assumptions, and tests before using them.
Can it assess dependency vulnerabilities?
Yes. It helps triage reachability, fix availability, install scripts, provenance, lockfiles, and documented exceptions. Run the native package-manager audit separately.
How does it address AI security?
It treats prompts, retrieved content, and model output as untrusted and reviews tool scope, data isolation, validation, confirmation, and consumption limits.
Entwicklerdetails
Autor
addyosmaniLizenz
MIT
Skillstore-Revision
r2
Versionshinweis
Der Autor hat keine Version angegeben.
Ref.
5d5054f8a23586f9b500fece1cb613a9dffc787b
Aktualität der Wartung
19.9.2026
Nutzung
1 Downloads · 0 Aufrufe
Dateistruktur
📄 SKILL.md