skills.rest
memasanz
memasanzCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

1|Updated May 29, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/memasanz/agent-harness --skill security-and-hardening-memasanz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/memasanz/agent-harness/tree/main/.github/skills/security-and-hardening
Command: npx skills add https://github.com/memasanz/agent-harness --skill security-and-hardening-memasanz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured threat-modeling process and concrete prevention patterns so security controls are built into code rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run a lightweight STRIDE analysis before writing security controls. - OWASP Prevention Patterns: Ready-to-use TypeScript examples for parameterized queries, bcrypt password hashing, session cookie flags, CSP headers, CORS restriction, and SSRF URL allowlisting. - Three-Tier Boundary System: Clear rules for what to always do, what requires human approval, and what to never do (e.g., never commit secrets, never trust client-side validation). - AI/LLM Security: Guidance mapped to the OWASP LLM Top 10 for treating model output as untrusted input and constraining agent tool permissions. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF pattern to allowlist hosts, resolve DNS, and reject private IP ranges before fetching. ## Quick Start Ask the agent to review your API route handlers for security issues and apply the hardening patterns for input validation, authentication, and headers.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

How do I protect against SSRF when fetching user-supplied URLs?▼

Protect against SSRF by allowlisting schemes and hostnames, resolving all DNS records, and rejecting any private or reserved IP ranges before fetching. Disable redirects and be aware of DNS-rebinding TOCTOU gaps on high-risk surfaces.

What session cookie settings should I use for authentication?▼

Session cookies should be httpOnly, secure, and sameSite to prevent JavaScript access, enforce HTTPS, and mitigate CSRF. Hash passwords with bcrypt, scrypt, or argon2, and apply stricter rate limits to authentication endpoints.

How should I triage npm audit vulnerability reports?▼

Triage npm audit results by severity and reachability: fix critical or high vulnerabilities in reachable code immediately, schedule moderate issues for the next release, and track low-severity items. Document a reason and review date when deferring any fix.

Does LLM output need validation before use in an application?▼

Yes, LLM output must be treated as untrusted input and never passed directly into eval, SQL, shells, or innerHTML. Parse it defensively, validate against a schema, and encode it before rendering, since prompts can be hijacked by injected instructions.

What should I do if a secret is accidentally committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not sufficient once it reaches a remote. After rotation, purge it from history and add the file pattern to .gitignore.

Related Skills

Explore More Software Engineering Skills→
NUMU-IONUMU-IO
2

speckit-security-review-plan

Review Spec-Kit planning artifacts for security weaknesses before implementation.

Official
Intermediate
zardusai-cyberzardusai-cyber
1

springboot-verification

Automate end-to-end verification of Spring Boot projects before PRs or releases.

Community
Advanced
igbuendigbuend
8

log-entity-actions-pattern

Implement a security pattern for logging entity actions to create an audit trail.

Community
Intermediate
bacocobacoco

ansible

Design idempotent Ansible playbooks and manage inventories with Ansible Vault.

Community
Advanced