# Harden Applications Against Common Vulnerabilities

Security weaknesses often enter through untrusted input, weak authorization, exposed secrets, and unsafe integrations. This skill provides practical controls and review checklists to reduce those risks before release.

## Install

```bash
npx skillstore add addyosmani/security-and-hardening
```

## Metadata

- Status: approved
- Slug: addyosmani-security-and-hardening
- Skillstore revision: r1
- Version status: missing
- Tree hash: 733dbde00a07445a293c95e7c6b0d1d6d3a08cfe963f8fae290a21ce726b6db2
- Author: addyosmani
- GitHub username: addyosmani
- License: MIT
- Repository: https://github.com/addyosmani/agent-skills/tree/be4e44a9fbc5e8df0beaefadbb28bd22ee61cc39/skills/security-and-hardening
- Ref: 5526951beaeca22519572a471618555839b53b05
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, network, filesystem, env\_access
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/addyosmani-security-and-hardening
- Manifest: https://skillstore.pages.dev/api/skills/addyosmani-security-and-hardening/manifest

## Capabilities

- Map trust boundaries and assets with a concise STRIDE threat model.
- Recommend validation, authorization, session, security-header, and rate-limiting controls.
- Identify unsafe SQL, HTML, URL-fetch, filesystem, and LLM-output handling patterns.
- Guide dependency audit triage, lockfile governance, and install-script review.
- Define secret-management, privacy, retention, consent, export, and deletion practices.

## Use Cases

- Review an API Endpoint: Map inputs and assets, then check validation, authorization, query handling, error responses, rate limits, and logging.
- Prepare a Secure Release: Triage dependency advisories, verify the lockfile and package manager, review install scripts, and check secret handling.
- Assess Privacy Controls: Classify personal data, define purpose and retention, and plan consent, export, deletion, and third-party sharing controls.

## Prompt Templates

### Find Basic Risks

```
Review this feature description for trust boundaries, sensitive assets, untrusted inputs, and likely abuse cases. List the highest-priority risks.
```

### Harden an Endpoint

```
Analyze this API endpoint design. Recommend concrete controls for validation, authentication, authorization, SQL, XSS, SSRF, errors, rate limits, and logging.
```

### Triage Dependency Findings

```
Evaluate these package audit results by severity, reachability, runtime exposure, available fixes, lockfile integrity, and installation-script risk. Provide an ordered remediation plan.
```

### Review an LLM Workflow

```
Threat-model this LLM workflow. Check prompt injection, output handling, secret exposure, tenant isolation, tool permissions, destructive actions, and consumption limits. Propose tests and code-level safeguards.
```

## Limitations

- It provides guidance and examples, but it does not modify or execute application code.
- It cannot prove that a control is correctly implemented without access to the complete application and deployment environment.
- It does not replace penetration testing, dependency intelligence, legal advice, or incident response.
- Recommendations require adaptation to the framework, hosting platform, data types, and threat model.

## Best Practices

- Validate and authorize data at every trust boundary, including model output and internal service messages.
- Keep secrets out of source, logs, prompts, responses, and client-accessible storage.
- Turn security guidance into abuse-case tests and verify controls in the target deployment.

## Anti Patterns

- Treating authentication as authorization or relying on client-side validation.
- Passing untrusted or model-generated text into SQL, shells, eval, HTML, or filesystem paths.
- Collecting personal data without a stated purpose, retention limit, consent path, or deletion workflow.

## Security Audit

- Audited at: 2026-09-12T11:57:58.491\+00:00
- Summary: All 96 static findings are false positives because the only scanned file is security guidance containing illustrative code and prevention examples. No executable implementation, prompt injection, or malicious data-exfiltration intent was found in SKILL.md.

## Stats

- Views: 0
- Downloads: 0
- Favorites: 0
- Popularity score: 0