skills.rest
TylerSimons1127
TylerSimons1127COMMUNITY
Explore all skills by this author →
GitHub

addy-security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated Aug 21, 2026
Search Tags:#OWASP#security#authentication#input validation#threat modeling#GDPR#hardening
One-click install
npx skills add https://github.com/TylerSimons1127/vibe --skill addy-security-and-hardening-tylersimons1127
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: addy-security-and-hardening
Source: https://github.com/TylerSimons1127/vibe/tree/main/skills/addy-security-and-hardening
Command: npx skills add https://github.com/TylerSimons1127/vibe --skill addy-security-and-hardening-tylersimons1127

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate third-party services ship with exploitable vulnerabilities when security is treated as an afterthought. This Skill embeds threat modeling, OWASP prevention patterns, and privacy compliance checks directly into the development workflow. ## Core Features & Use Cases - Threat Modeling with STRIDE: Maps trust boundaries, names assets, and runs STRIDE analysis per boundary before writing controls, addressing OWASP A04 Insecure Design. - OWASP Prevention Patterns: Provides TypeScript code patterns for injection, broken authentication, XSS, broken access control, SSRF, and security misconfiguration, plus a dedicated section on securing AI/LLM features against prompt injection and excessive agency. - Supply-Chain and Privacy Governance: Covers dependency audit triage by reachability, install-script gating per package manager, secrets management, and GDPR/CCPA data classification with retention and deletion paths. - Use Case: When building an API endpoint that accepts file uploads and calls an LLM, use this Skill to validate input with Zod schemas, restrict upload types and sizes, treat model output as untrusted data, and verify the security review checklist before release. ## Quick Start Review this Express API route for security vulnerabilities and apply the hardening checklist before I deploy it.

Frequently Asked Questions about addy-security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma parameterize inputs automatically when you pass values through their query methods.

How to secure Express apps with security headers?▼

Use the helmet middleware to set security headers including Content-Security-Policy, HSTS, X-Frame-Options, and X-Content-Type-Options. Configure CSP directives to restrict script and connection sources, and limit CORS to known origins rather than wildcards.

How do I protect LLM features from prompt injection?▼

Treat all model output as untrusted input: never pass it into eval, SQL, shells, or innerHTML. Enforce permissions in code rather than the system prompt, keep secrets out of the context window, scope tool permissions, and cap token consumption.

Should I run npm audit fix --force automatically?▼

No, never apply forced audit remediation automatically because it may cross declared dependency ranges. Preview the remediation, read changelogs, test each upgrade, and triage findings by whether the vulnerable code is actually reachable in your runtime paths.

What password hashing algorithm should I use for authentication?▼

Use bcrypt with at least 12 salt rounds, scrypt, or argon2 for password hashing, and never store plaintext passwords. Combine this with httpOnly, secure, sameSite session cookies and rate limiting of 10 attempts per 15 minutes on login endpoints.

When is threat modeling necessary for a feature?▼

Threat modeling is necessary whenever a feature crosses a trust boundary: HTTP requests, file uploads, webhooks, third-party APIs, or LLM output. A five-minute STRIDE pass per boundary prevents design flaws that no later control can patch.

Related Skills

Explore More Software Engineering Skills→
mahg-esmahg-es
3

threat-model

Identify STRIDE threats in system designs and produce formal threat-model documents.

Official
Advanced
tannergoldentannergolden

Operator

Automate system operations oversight and incident response workflows.

Community
Advanced
WrongStackWrongStack
224

observability

Instrument WrongStack applications with structured logs, traces, and metrics.

Official
Advanced
jdiegosierrajdiegosierra

security-reviewer

...

Community
Advanced