skills.rest
avel123111
avel123111COMMUNITY
Explore all skills by this author →
GitHub

agent-skills-security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated May 26, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/avel123111/triplanio --skill agent-skills-security-and-hardening-avel123111
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agent-skills-security-and-hardening
Source: https://github.com/avel123111/triplanio/tree/main/.claude/skills/agent-skills-security-and-hardening
Command: npx skills add https://github.com/avel123111/triplanio --skill agent-skills-security-and-hardening-avel123111

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured security review process so vulnerabilities are caught during development rather than after a breach. ## Core Features & Use Cases - Threat Modeling with STRIDE: Maps trust boundaries and assets, then runs spoofing, tampering, repudiation, information disclosure, denial of service, and elevation-of-privilege analysis before writing controls. - OWASP Prevention Patterns: Provides concrete code patterns for parameterized queries, bcrypt password hashing, session cookie flags, CSP headers, CORS restriction, SSRF URL allowlisting, and Zod schema validation. - LLM Security Guidance: Covers prompt injection, untrusted model output handling, tool permission scoping, and RAG tenant isolation based on the OWASP LLM Top 10. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF pattern to validate the scheme, allowlist hosts, resolve DNS, and reject private IP ranges before fetching. ## Quick Start Review my new API endpoint for security issues and apply the appropriate hardening patterns from the security checklist.

Frequently Asked Questions about agent-skills-security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

How to prevent SSRF when fetching user-supplied URLs?▼

Prevent SSRF by allowlisting hosts, requiring HTTPS, resolving all DNS records, and rejecting any private or reserved IP ranges before fetching. Disable redirects, and note the remaining DNS-rebinding TOCTOU gap may require a filtering proxy for high-risk surfaces.

What session cookie settings prevent session hijacking?▼

Set session cookies with httpOnly to block JavaScript access, secure to require HTTPS, and sameSite to mitigate CSRF. Store the session secret in environment variables and never keep auth tokens in localStorage.

How should I triage npm audit vulnerabilities?▼

Triage npm audit results by severity and reachability: fix critical or high findings immediately if the vulnerable code path is reachable, schedule moderate fixes for the next release, and track low findings. Document deferred fixes with a reason and review date.

Why is LLM output a security risk in web applications?▼

LLM output is untrusted input that can contain SQL, script tags, or shell commands due to prompt injection. Never pass model output into eval, innerHTML, SQL, or shells; parse it defensively, validate against a schema, and encode it before rendering.

What should I do if a secret is committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, since deleting the line or rewriting history is not sufficient. Assume any secret that reached a remote repository is compromised, then purge it from history after rotation.

Related Skills

Explore More Software Engineering Skills→
Handy369Handy369

security-and-hardening

Map trust boundaries and attacker paths in software changes.

Community
Intermediate
Arete-ConsortiumArete-Consortium
4

security-auditor

Runs SAST and OWASP audits with LLM-triaged findings and remediation patches.

Official
Advanced
Renzo-TognellaRenzo-Tognella

detecting-anomalous-authentication-patterns

Detect anomalous authentication patterns in logs using UEBA and machine learning.

Community
Advanced
HenderOrlandoHenderOrlando

seguridad-avanzada

Implement advanced IAM, session controls, anomaly detection, and KMS encryption.

Community
Advanced