skills.rest
LonelyTraderBay
LonelyTraderBayCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated May 19, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#ssrf#llm security
One-click install
npx skills add https://github.com/LonelyTraderBay/vittrade-flutter --skill security-and-hardening-lonelytraderbay
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/LonelyTraderBay/vittrade-flutter/tree/main/.agents/skills/security-and-hardening
Command: npx skills add https://github.com/LonelyTraderBay/vittrade-flutter --skill security-and-hardening-lonelytraderbay

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured threat-modeling process and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE analysis before writing code, with abuse cases written alongside use cases. - OWASP Prevention Patterns: Ready-to-use TypeScript examples for parameterized queries, bcrypt password hashing, session cookie configuration, CSP headers, CORS restriction, SSRF URL allowlisting, and Zod schema validation. - Three-Tier Boundary System: Clear rules for what to always do, what requires human approval, and what to never do (e.g., never commit secrets, never trust client-side validation). - AI/LLM Security: Guidance mapped to the OWASP LLM Top 10 for treating model output as untrusted input and constraining agent permissions. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF pattern to allowlist hosts, reject private IPs, and disable redirects before shipping. ## Quick Start Ask the agent to review the new authentication endpoint for security vulnerabilities and apply the hardening checklist before committing.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

How do I protect a server from SSRF attacks on webhook URLs?▼

Protect against SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. Note the remaining TOCTOU gap where DNS can be rebound between validation and connection, so high-risk surfaces should pin the resolved IP.

What session cookie settings should I use for authentication?▼

Session cookies should be httpOnly so JavaScript cannot read them, secure so they only travel over HTTPS, and sameSite set to lax or strict for CSRF protection. Hash passwords with bcrypt, scrypt, or argon2 and never store tokens in localStorage.

How do I triage npm audit vulnerabilities?▼

Triage npm audit results by severity and reachability: fix critical or high findings immediately if the vulnerable code path is reachable, schedule moderate issues for the next release, and track low-severity items. Document any deferred fix with a reason and review date.

Is LLM output safe to render directly in the DOM?▼

No, LLM output must be treated as untrusted input under OWASP LLM05. Never pass model output into eval, SQL, a shell, or innerHTML; parse it defensively, validate against a schema, and encode it before rendering, for example using textContent instead of innerHTML.

What should I do if a secret was committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not sufficient once it reaches a remote. After rotation, purge it from history and add env files and key files to .gitignore.

Related Skills

Explore More Software Engineering Skills→
NUMU-IONUMU-IO
2

speckit-security-review-plan

Review Spec-Kit planning artifacts for security weaknesses before implementation.

Official
Intermediate
Fabric-ProFabric-Pro
3

threat-hunting

Detect security threats, vulnerabilities, and suspicious patterns in applications and infrastructure.

Official
Basic
Asymmetric-alAsymmetric-al
417

code-review

Automate pull request code reviews for security, performance, quality, and testing issues.

Official
Advanced
JEO-tech-aiJEO-tech-ai
8

security-best-practices

Harden Express.js web applications with OWASP-aligned security configurations.

Community
Advanced