skills.rest
ankaboot-source
ankaboot-sourceOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Harden web application code against OWASP vulnerabilities, SSRF, and LLM-specific attack surfaces.

2|Updated Jul 25, 2026
Search Tags:#security#authentication#owasp#threat modeling#hardening#ssrf#llm security
One-click install
npx skills add https://github.com/ankaboot-source/boucle --skill security-and-hardening-ankaboot-source
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/ankaboot-source/boucle/tree/main/.jcode/skills/security-and-hardening
Command: npx skills add https://github.com/ankaboot-source/boucle --skill security-and-hardening-ankaboot-source

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services ship with exploitable vulnerabilities when security is treated as an afterthought. This Skill embeds threat modeling and concrete prevention patterns into every feature that touches untrusted data, authentication, or third-party integrations. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run a structured STRIDE analysis before writing controls, addressing OWASP A04 Insecure Design. - OWASP Prevention Patterns: Ready-to-use TypeScript code for parameterized queries, bcrypt password hashing, session cookie configuration, CSP headers via helmet, Zod schema validation, and SSRF-safe URL fetching with DNS resolution checks. - Supply-Chain and Dependency Auditing: A decision tree for triaging audit findings by severity and reachability, plus lockfile integrity, install-script blocking, and typosquat detection guidance. - LLM Security Controls: Defenses mapped to the OWASP LLM Top 10, covering prompt injection, untrusted model output, excessive agency, and RAG tenant isolation. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern to block requests to internal IPs and cloud metadata endpoints before merging. ## Quick Start Review this new authentication endpoint for security vulnerabilities and apply the hardening patterns from the security skill.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their standard query methods.

How do I protect against SSRF when fetching user-supplied URLs?▼

Protect against SSRF by allowlisting schemes and hostnames, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. Note the TOCTOU gap where DNS can rebind between validation and connection, so high-risk surfaces should pin the resolved IP.

What password hashing algorithm should I use for authentication?▼

Use bcrypt, scrypt, or argon2 for password hashing, never plaintext storage. With bcrypt, use at least 12 salt rounds and the compare function for verification rather than re-hashing and string comparison.

How do I secure LLM output in my application?▼

Treat all LLM output as untrusted input: never pass it to eval, SQL, shell commands, or innerHTML. Parse it defensively with JSON.parse and schema validation, then encode it before rendering, and keep secrets and cross-tenant data out of prompts.

Should I run npm audit fix --force to resolve vulnerabilities?▼

Never apply forced audit remediation automatically, since forced fixes may cross declared dependency ranges and break your application. Instead triage findings by severity and reachability, preview remediations, read changelogs, and test each upgrade individually.

When is threat modeling necessary for a feature?▼

Threat modeling is necessary whenever a feature crosses a trust boundary, such as accepting user input, handling authentication, storing sensitive data, or integrating external services. A five-minute STRIDE pass over each boundary prevents design flaws that no later control can patch.

Related Skills

Explore More Software Engineering Skills→
NealschNealsch

Forge-API-Design

Designs API contracts defining endpoints, request and response models, errors, and versioning.

Community
Intermediate
ZaxbyHubZaxbyHub

dependency-ci-contract

Validates dependency and lockfile changes against CI typecheck and build gates.

Official
Basic
g-zenrg-zenr

security-audit

Audit codebases for security vulnerabilities across authentication, authorization, and dependencies.

Community
Advanced
bobmatnycbobmatnyc
68

vercel-security-access

Manage Vercel security controls including RBAC, SSO, and deployment protection.

Community
Intermediate