security-and-hardening
Harden Applications Against Common Vulnerabilities
Security weaknesses often enter through untrusted input, weak authorization, exposed secrets, and unsafe integrations. This skill provides practical controls and review checklists to reduce those risks before release.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Review the Skillstore skill "security-and-hardening" from https://skillstore.io/skills/addyosmani-security-and-hardening.md and its manifest at https://skillstore.io/api/skills/addyosmani-security-and-hardening/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "security-and-hardening". A webhook endpoint accepts a URL and fetches it on the server.
Resultado esperado:
- Risk: server-side request forgery can reach internal services or cloud metadata.
- Control: allow only approved HTTPS hosts, resolve all addresses, reject private ranges, and disable redirects.
- Test: verify blocked localhost, private IP, metadata, redirect, and DNS-rebinding cases.
Usando "security-and-hardening". A team wants to store login tokens in browser storage.
Resultado esperado:
Use secure, httpOnly, sameSite cookies for sessions. Add expiration, rotation, CSRF defenses, and server-side authorization checks.
Usando "security-and-hardening". An application sends customer records to an analytics or LLM vendor.
Resultado esperado:
- Classify the fields and remove data that is not required.
- Obtain and record appropriate consent before sharing.
- Confirm contractual, retention, residency, access, and deletion controls with the vendor.
Auditoría de seguridad
SeguroAll 96 static findings are false positives because the only scanned file is security guidance containing illustrative code and prevention examples. No executable implementation, prompt injection, or malicious data-exfiltration intent was found in SKILL.md.
Factores de riesgo
⚡ Contiene scripts (3)
⚙️ Comandos externos (50)
🌐 Acceso a red (6)
📁 Acceso al sistema de archivos (4)
🔑 Variables de entorno (9)
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/addyosmani-security-and-hardening/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-security-and-hardening/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/addyosmani-security-and-hardening.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
addyosmani. (2026). security-and-hardening security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-security-and-hardening/audits/1Cita BibTeX
@techreport{addyosmani-addyosmani-security-and-hardening-2026,
author = {addyosmani},
title = {security-and-hardening security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/addyosmani-security-and-hardening/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-and-hardening security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "addyosmani"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/addyosmani-security-and-hardening/audits/1"
identifiers:
- type: other
value: "skillstore:addyosmani-security-and-hardening:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: MedioLo que puedes crear
Review an API Endpoint
Map inputs and assets, then check validation, authorization, query handling, error responses, rate limits, and logging.
Prepare a Secure Release
Triage dependency advisories, verify the lockfile and package manager, review install scripts, and check secret handling.
Assess Privacy Controls
Classify personal data, define purpose and retention, and plan consent, export, deletion, and third-party sharing controls.
Prueba estos prompts
Review this feature description for trust boundaries, sensitive assets, untrusted inputs, and likely abuse cases. List the highest-priority risks.
Analyze this API endpoint design. Recommend concrete controls for validation, authentication, authorization, SQL, XSS, SSRF, errors, rate limits, and logging.
Evaluate these package audit results by severity, reachability, runtime exposure, available fixes, lockfile integrity, and installation-script risk. Provide an ordered remediation plan.
Threat-model this LLM workflow. Check prompt injection, output handling, secret exposure, tenant isolation, tool permissions, destructive actions, and consumption limits. Propose tests and code-level safeguards.
Mejores prácticas
- Validate and authorize data at every trust boundary, including model output and internal service messages.
- Keep secrets out of source, logs, prompts, responses, and client-accessible storage.
- Turn security guidance into abuse-case tests and verify controls in the target deployment.
Evitar
- Treating authentication as authorization or relying on client-side validation.
- Passing untrusted or model-generated text into SQL, shells, eval, HTML, or filesystem paths.
- Collecting personal data without a stated purpose, retention limit, consent path, or deletion workflow.
Preguntas frecuentes
What does this skill review?
Does it run security scans?
Can it secure an existing application?
Does it replace penetration testing?
How does it handle secrets?
Can it review LLM applications?
Detalles del desarrollador
Autor
addyosmaniLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
5526951beaeca22519572a471618555839b53b05
Actualidad del mantenimiento
14/9/2026
Uso
0 descargas · 0 vistas
Estructura de archivos
📄 SKILL.md