技能 security-and-hardening
📦

security-and-hardening

内容修订 r2 安全 ⚡ 包含脚本⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

Harden Applications Against Security Risks

Security reviews can miss trust boundaries and unsafe data flows. This skill supplies threat-modeling prompts, OWASP patterns, and practical review checklists.

支持: Claude Codex Code(CC)
🥉 78 青铜

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "security-and-hardening" from https://skillstore.io/skills/addyosmani-security-and-hardening.md and its manifest at https://skillstore.io/api/skills/addyosmani-security-and-hardening/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/addyosmani-security-and-hardening.md 已签名 manifest GET /api/skills/addyosmani-security-and-hardening/manifest 已签名 lockfile GET /api/skills/addyosmani-security-and-hardening/lockfile

测试它

正在使用“security-and-hardening”。 Review an endpoint that accepts a webhook URL and fetches it on behalf of a user.

预期结果:

  • Risk: The server may be vulnerable to SSRF if it fetches arbitrary user-supplied URLs.
  • Control: Allowlist HTTPS hosts, resolve all addresses, reject private or reserved ranges, and disable redirects.
  • Verification: Test loopback, link-local, private IPv4, IPv6, redirect, and DNS-rebinding cases.

正在使用“security-and-hardening”。 Assess an LLM feature that renders model replies in a web page.

预期结果:

  • Risk: Model output is untrusted and may become stored XSS when inserted as HTML.
  • Control: Encode output as text by default, or sanitize approved markup before rendering.
  • Verification: Test script payloads, event handlers, malformed markup, and content from retrieved documents.

正在使用“security-and-hardening”。 Triage a high-severity package advisory from a native package-manager audit.

预期结果:

  • Decision: Confirm whether the vulnerable function is reachable in production, build, test, or deployment paths.
  • Action: Update to a patched version when available, review the lockfile diff, and test the resulting dependency graph.
  • Exception: Document a temporary deferral, mitigation, owner, and review date when the vulnerable path is confirmed unused.

安全审计

安全
v2 • 2026/9/19 打开版本化报告

All 96 findings are false positives from examples and Markdown in SKILL.md. No executable behavior or prompt injection was found.

1
已扫描文件
525
分析行数
0
复核项
0
已忽略误报

风险因素

⚡ 包含脚本 (3)
SKILL.md:71 SKILL.md:120 SKILL.md:414
⚙️ 外部命令 (50)
SKILL.md:71 SKILL.md:77 SKILL.md:81-83 SKILL.md:83-90 SKILL.md:90-94 SKILL.md:94-114 SKILL.md:114-118 SKILL.md:118-128 SKILL.md:128-132 SKILL.md:132-148 SKILL.md:148-152 SKILL.md:152-173 SKILL.md:173-177 SKILL.md:177-187 SKILL.md:187-191 SKILL.md:191-193 SKILL.md:193-216 SKILL.md:216-218 SKILL.md:218 SKILL.md:220 SKILL.md:226-252 SKILL.md:252-256 SKILL.md:256-270 SKILL.md:270-276 SKILL.md:276-284 SKILL.md:284-298 SKILL.md:298-311 SKILL.md:311 SKILL.md:316-317 SKILL.md:317 SKILL.md:318 SKILL.md:322-338 SKILL.md:338-340 SKILL.md:340 SKILL.md:342-350 SKILL.md:350-352 SKILL.md:352-356 SKILL.md:356-368 SKILL.md:368-371 SKILL.md:371-374 SKILL.md:374-391 SKILL.md:391-397 SKILL.md:397-403 SKILL.md:403 SKILL.md:410-412 SKILL.md:412-425 SKILL.md:425-429 SKILL.md:429-471 SKILL.md:471-474 SKILL.md:474-498
🌐 网络访问 (6)
SKILL.md:195 SKILL.md:215 SKILL.md:218 SKILL.md:170 SKILL.md:401 SKILL.md:218
📁 文件系统访问 (4)
SKILL.md:77 SKILL.md:276 SKILL.md:311 SKILL.md:474
🔑 环境变量 (9)
SKILL.md:104 SKILL.md:170 SKILL.md:185 SKILL.md:104 SKILL.md:170 SKILL.md:185 SKILL.md:185 SKILL.md:186 SKILL.md:373
最新一次完成的静态与语义审计未检测到已确认的安全发现。这并不能证明该 Skill 没有副作用。
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-security-and-hardening/security.svg)](https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/addyosmani-security-and-hardening?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-security-and-hardening/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/addyosmani-security-and-hardening.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

addyosmani. (2026). security-and-hardening security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2

BibTeX 引用

@techreport{addyosmani-addyosmani-security-and-hardening-2026, author = {addyosmani}, title = {security-and-hardening security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-and-hardening security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "addyosmani" date-released: "2026-09-19" url: "https://skillstore.io/skills/addyosmani-security-and-hardening/audits/2" identifiers: - type: other value: "skillstore:addyosmani-security-and-hardening:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
87
规范符合性

你能构建什么

Review a New API Endpoint

Map trust boundaries, validate request data, check authorization, and identify abuse cases before shipping an endpoint.

Assess a Dependency Update

Triage audit results by reachability, review install scripts and provenance, and define a documented remediation decision.

Secure an AI Feature

Evaluate prompt injection, unsafe model output, excessive tool permissions, data exposure, and unbounded consumption risks.

试试这些提示

Basic Security Review 
Review this feature for trust boundaries, untrusted inputs, authentication, authorization, and sensitive data exposure. List the three most important fixes.
OWASP Endpoint Review 
Audit this API endpoint against relevant OWASP risks. Check validation, queries, output encoding, access control, rate limits, errors, and logging. Cite issues and propose fixes.
Dependency Risk Triage 
Triage these package audit results. Check reachability, available fixes, install scripts, provenance, and lockfile impact. Recommend an action and review date.
AI System Threat Model 
Threat-model this LLM feature. Analyze prompt injection, unsafe output, data exposure, tool permissions, retrieval isolation, SSRF, limits, and irreversible actions. Prioritize controls and tests.

最佳实践

  • Start with assets, trust boundaries, abuse cases, and authorization assumptions before choosing controls.
  • Treat user input, external responses, files, environment values, and model output as untrusted until validated.
  • Pair every recommendation with an implementation check, a negative test, and an owner for follow-up.

避免

  • Do not treat a prompt, client-side check, framework default, or internal network as a complete security boundary.
  • Do not pass untrusted data into SQL, shells, eval, HTML, file paths, or privileged tools without strict validation.
  • Do not accept audit results, dependency signatures, or compliance claims as proof without checking reachability and context.

常见问题

Does this skill scan my repository?
No. It provides review guidance and checklists. Use dedicated scanners and human review to inspect repository and runtime behavior.
Which security topics does it cover?
It covers threat modeling, OWASP risks, authentication, authorization, input validation, XSS, SSRF, files, secrets, privacy, dependencies, and LLM features.
Can it replace a penetration test?
No. It supports design and code review but cannot replace penetration testing, configuration review, monitoring, or incident exercises.
How should I use its code examples?
Treat examples as patterns to adapt. Confirm framework behavior, error handling, permissions, deployment assumptions, and tests before using them.
Can it assess dependency vulnerabilities?
Yes. It helps triage reachability, fix availability, install scripts, provenance, lockfiles, and documented exceptions. Run the native package-manager audit separately.
How does it address AI security?
It treats prompts, retrieved content, and model output as untrusted and reviews tool scope, data isolation, validation, confirmation, and consumption limits.

开发者详情

作者

addyosmani

许可证

MIT

Skillstore 修订

r2

版本提示

作者未声明版本。

仓库

https://github.com/addyosmani/agent-skills/tree/c004a74784a08295d52749b04cda634125b9a581/skills/security-and-hardening

引用

5d5054f8a23586f9b500fece1cb613a9dffc787b

维护新鲜度

2026/9/19

使用量

1 次下载 · 0 次浏览

文件结构

📄 SKILL.md

addyosmani 的更多技能

查看全部

相关技能

查看全部