skills.rest
authrain-cloud-abdullahformuli
authrain-cloud-abdullahformuliCOMMUNITY
Explore all skills by this author →
𝕏@abdullahformuliGitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities, SSRF, injection, and supply-chain risks.

Updated Sep 17, 2026
Search Tags:#security#authentication#owasp#threat modeling#dependency audit#hardening#ssrf
One-click install
npx skills add https://github.com/authrain-cloud-abdullahformuli/agent-skills --skill security-and-hardening-authrain-cloud-abdullahformuli
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/authrain-cloud-abdullahformuli/agent-skills/tree/main/skills/security-and-hardening
Command: npx skills add https://github.com/authrain-cloud-abdullahformuli/agent-skills --skill security-and-hardening-authrain-cloud-abdullahformuli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, broken access control, SSRF, and supply-chain attacks. This Skill gives an AI agent a threat-model-first workflow and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Maps trust boundaries, names assets, and runs a lightweight STRIDE pass before writing controls, covering OWASP A04 insecure design. - OWASP Top 10 Prevention Patterns: Provides copy-ready TypeScript examples for parameterized queries, bcrypt password hashing, secure session cookies, CSP headers, CORS restriction, output encoding, and SSRF-safe URL fetching with DNS resolution checks. - Dependency and Supply-Chain Triage: Supplies a severity-and-reachability decision tree for package-manager audit findings, plus lockfile integrity, install-script blocking, and typosquat detection guidance. - Privacy and LLM Security: Covers GDPR/CCPA data classification, retention, and deletion paths, plus OWASP LLM Top 10 rules for treating model output as untrusted input. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern to block requests to internal IPs like 169.254.169.254 before shipping. ## Quick Start Ask the agent to audit your login flow or new API endpoint against the OWASP Top Ten and apply the security checklist before committing.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Never interpolate user input directly into query strings.

How do I protect a server from SSRF when fetching user-supplied URLs?▼

Protect against SSRF by allowlisting schemes and hostnames, resolving all DNS records and rejecting any private or reserved IP range, and disabling redirects. Be aware of the TOCTOU DNS-rebinding gap; for high-risk surfaces pin the resolved IP or use a filtering agent.

What password hashing algorithm should I use for authentication?▼

Use bcrypt, scrypt, or argon2 for password hashing, never plaintext or fast hashes. The Skill's examples use bcrypt with a cost factor of 12 salt rounds, combined with httpOnly, secure, sameSite session cookies.

How should I triage npm audit vulnerabilities?▼

Triage audit findings by severity and reachability: fix reachable critical and high issues immediately, schedule moderate ones for the next release, and track low ones. Never run npm audit fix --force blindly; review changelogs and verify lockfile integrity first.

Does express-rate-limit work behind a load balancer?▼

No, express-rate-limit uses in-memory counters by default, so each instance counts separately and the effective limit multiplies by instance count. Use a shared store such as Redis via rate-limit-redis or an HTTP-based limiter like @upstash/ratelimit for serverless.

How do I secure LLM output in my application?▼

Treat all LLM output as untrusted input: never pass it to eval, SQL, shell, or innerHTML. Parse it defensively with a schema validator like zod, run only allowlisted actions, and keep secrets and other users' data out of the prompt context.

Related Skills

Explore More Software Engineering Skills→
helderbertohelderberto
12

harden

Harden code at trust boundaries with explicit validation and secure defaults.

Community
Advanced
fallow-rsfallow-rs
4.4k

review

Reviews branches, pull requests, and diffs against Fallow's pre-merge quality gates.

Official
Intermediate
kreuzberg-devkreuzberg-dev
836

security-logging-and-audit

Log security events for audit trails while preventing sensitive data exposure.

Official
Intermediate
do360nowdo360now

gcp-review

Assess Google Cloud Platform environments against CIS benchmarks for security compliance.

Community
Intermediate