스킬 security-and-hardening
📦
security-and-hardening
콘텐츠 리비전 r2 안전 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수
Harden Applications Against Security Risks
Security reviews can miss trust boundaries and unsafe data flows. This skill supplies threat-modeling prompts, OWASP patterns, and practical review checklists.
지원: Claude Codex Code(CC)
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "security-and-hardening" from https://skillstore.io/skills/addyosmani-security-and-hardening.md and its manifest at https://skillstore.io/api/skills/addyosmani-security-and-hardening/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"security-and-hardening" 사용 중입니다. Review an endpoint that accepts a webhook URL and fetches it on behalf of a user.
예상 결과:
- Risk: The server may be vulnerable to SSRF if it fetches arbitrary user-supplied URLs.
- Control: Allowlist HTTPS hosts, resolve all addresses, reject private or reserved ranges, and disable redirects.
- Verification: Test loopback, link-local, private IPv4, IPv6, redirect, and DNS-rebinding cases.
"security-and-hardening" 사용 중입니다. Assess an LLM feature that renders model replies in a web page.
예상 결과:
- Risk: Model output is untrusted and may become stored XSS when inserted as HTML.
- Control: Encode output as text by default, or sanitize approved markup before rendering.
- Verification: Test script payloads, event handlers, malformed markup, and content from retrieved documents.
"security-and-hardening" 사용 중입니다. Triage a high-severity package advisory from a native package-manager audit.
예상 결과:
- Decision: Confirm whether the vulnerable function is reachable in production, build, test, or deployment paths.
- Action: Update to a patched version when available, review the lockfile diff, and test the resulting dependency graph.
- Exception: Document a temporary deferral, mitigation, owner, and review date when the vulnerable path is confirmed unused.
보안 감사
안전v2 • 2026. 9. 19. 버전별 보고서 열기
All 96 findings are false positives from examples and Markdown in SKILL.md. No executable behavior or prompt injection was found.
1
스캔된 파일
525
분석된 줄 수
0
검토 항목
0
오탐 무시됨
위험 요인
⚡ 스크립트 포함 (3)
⚙️ 외부 명령어 (50)
SKILL.md:71 SKILL.md:77 SKILL.md:81-83 SKILL.md:83-90 SKILL.md:90-94 SKILL.md:94-114 SKILL.md:114-118 SKILL.md:118-128 SKILL.md:128-132 SKILL.md:132-148 SKILL.md:148-152 SKILL.md:152-173 SKILL.md:173-177 SKILL.md:177-187 SKILL.md:187-191 SKILL.md:191-193 SKILL.md:193-216 SKILL.md:216-218 SKILL.md:218 SKILL.md:220 SKILL.md:226-252 SKILL.md:252-256 SKILL.md:256-270 SKILL.md:270-276 SKILL.md:276-284 SKILL.md:284-298 SKILL.md:298-311 SKILL.md:311 SKILL.md:316-317 SKILL.md:317 SKILL.md:318 SKILL.md:322-338 SKILL.md:338-340 SKILL.md:340 SKILL.md:342-350 SKILL.md:350-352 SKILL.md:352-356 SKILL.md:356-368 SKILL.md:368-371 SKILL.md:371-374 SKILL.md:374-391 SKILL.md:391-397 SKILL.md:397-403 SKILL.md:403 SKILL.md:410-412 SKILL.md:412-425 SKILL.md:425-429 SKILL.md:429-471 SKILL.md:471-474 SKILL.md:474-498
🌐 네트워크 접근 (6)
📁 파일 시스템 접근 (4)
가장 최근에 완료된 정적·의미론적 감사에서 확인된 보안 발견 사항이 감지되지 않았습니다. 이는 스킬에 부작용이 없음을 증명하지 않습니다.
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-security-and-hardening/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/addyosmani-security-and-hardening.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
addyosmani. (2026). security-and-hardening security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2BibTeX 인용
@techreport{addyosmani-addyosmani-security-and-hardening-2026,
author = {addyosmani},
title = {security-and-hardening security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-and-hardening security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "addyosmani"
date-released: "2026-09-19"
url: "https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2"
identifiers:
- type: other
value: "skillstore:addyosmani-security-and-hardening:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
85
유지보수성
87
콘텐츠
65
커뮤니티
87
사양 준수
만들 수 있는 것
Review a New API Endpoint
Map trust boundaries, validate request data, check authorization, and identify abuse cases before shipping an endpoint.
Assess a Dependency Update
Triage audit results by reachability, review install scripts and provenance, and define a documented remediation decision.
Secure an AI Feature
Evaluate prompt injection, unsafe model output, excessive tool permissions, data exposure, and unbounded consumption risks.
이 프롬프트를 사용해 보세요
Basic Security Review
Review this feature for trust boundaries, untrusted inputs, authentication, authorization, and sensitive data exposure. List the three most important fixes.
OWASP Endpoint Review
Audit this API endpoint against relevant OWASP risks. Check validation, queries, output encoding, access control, rate limits, errors, and logging. Cite issues and propose fixes.
Dependency Risk Triage
Triage these package audit results. Check reachability, available fixes, install scripts, provenance, and lockfile impact. Recommend an action and review date.
AI System Threat Model
Threat-model this LLM feature. Analyze prompt injection, unsafe output, data exposure, tool permissions, retrieval isolation, SSRF, limits, and irreversible actions. Prioritize controls and tests.
모범 사례
- Start with assets, trust boundaries, abuse cases, and authorization assumptions before choosing controls.
- Treat user input, external responses, files, environment values, and model output as untrusted until validated.
- Pair every recommendation with an implementation check, a negative test, and an owner for follow-up.
피하기
- Do not treat a prompt, client-side check, framework default, or internal network as a complete security boundary.
- Do not pass untrusted data into SQL, shells, eval, HTML, file paths, or privileged tools without strict validation.
- Do not accept audit results, dependency signatures, or compliance claims as proof without checking reachability and context.
자주 묻는 질문
Does this skill scan my repository?
No. It provides review guidance and checklists. Use dedicated scanners and human review to inspect repository and runtime behavior.
Which security topics does it cover?
It covers threat modeling, OWASP risks, authentication, authorization, input validation, XSS, SSRF, files, secrets, privacy, dependencies, and LLM features.
Can it replace a penetration test?
No. It supports design and code review but cannot replace penetration testing, configuration review, monitoring, or incident exercises.
How should I use its code examples?
Treat examples as patterns to adapt. Confirm framework behavior, error handling, permissions, deployment assumptions, and tests before using them.
Can it assess dependency vulnerabilities?
Yes. It helps triage reachability, fix availability, install scripts, provenance, lockfiles, and documented exceptions. Run the native package-manager audit separately.
How does it address AI security?
It treats prompts, retrieved content, and model output as untrusted and reviews tool scope, data isolation, validation, confirmation, and consumption limits.
개발자 세부 정보
작성자
addyosmani라이선스
MIT
Skillstore 리비전
r2
버전 안내
작성자가 버전을 선언하지 않았습니다.
참조
5d5054f8a23586f9b500fece1cb613a9dffc787b
유지보수 최신성
2026. 9. 19.
사용량
1 다운로드 · 0 조회
파일 구조
📄 SKILL.md