skills.rest
MoofonLi
MoofonLiCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

2|Updated Jul 11, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/MoofonLi/dev-ready --skill security-and-hardening-moofonli
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/MoofonLi/dev-ready/tree/main/src/dev_ready/templates/claude/skills/security-and-hardening
Command: npx skills add https://github.com/MoofonLi/dev-ready --skill security-and-hardening-moofonli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured security workflow so these risks are addressed during development rather than after a breach. ## Core Features & Use Cases - Threat Modeling First: Maps trust boundaries and runs a lightweight STRIDE analysis before writing controls, so mitigations target real attack surface. - OWASP Prevention Patterns: Provides concrete code patterns for injection, broken authentication, XSS, access control, security misconfiguration, sensitive data exposure, and SSRF, plus input validation with schema libraries like zod. - Supply-Chain and Dependency Triage: Guides lockfile discipline, native package-manager audits, reachability-based severity triage, and blocking unreviewed dependency install scripts. - Privacy and LLM Security: Covers GDPR/CCPA data classification, retention, and deletion paths, plus OWASP LLM Top 10 risks such as prompt injection and untrusted model output. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern with DNS resolution checks to block requests to internal services and cloud metadata endpoints. ## Quick Start Ask your coding agent to apply the security-and-hardening skill to review the authentication and input validation of the current feature before merging.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in a web application?▼

Prevent SQL injection by using parameterized queries or an ORM instead of concatenating user input into SQL strings. For example, pass the user ID as a bound parameter like db.query('SELECT * FROM users WHERE id = $1', [userId]).

How do I protect a server from SSRF when fetching user-supplied URLs?▼

Protect against SSRF by allowlisting schemes and hosts, resolving all DNS records, and rejecting any private or reserved IP ranges such as 169.254.169.254. Disable redirects and be aware of DNS-rebinding TOCTOU gaps on high-risk surfaces.

What security headers should an Express app set?▼

Use helmet to set CSP, HSTS, X-Frame-Options, and X-Content-Type-Options headers. Configure a restrictive Content Security Policy and limit CORS to known origins rather than using wildcard origins.

Does npm audit fix make dependencies safe to use?▼

No. Audits only match known advisories and cannot detect newly malicious or typosquatted packages. Never run forced fixes automatically; preview remediation, read changelogs, verify signatures and provenance, and block unreviewed install scripts.

How should LLM output be handled securely in an app?▼

Treat all model output as untrusted input: never pass it into eval, SQL, a shell, or innerHTML. Parse it defensively, validate it against a schema, encode it before rendering, and keep secrets and other users' data out of the prompt context.

When should security changes require human approval?▼

Adding authentication flows, storing new categories of PII or payment data, changing CORS, adding file upload handlers, modifying rate limits, or granting elevated permissions all require human approval before implementation.

Related Skills

Explore More Software Engineering Skills→
BorisserzBorisserz
1

security-and-hardening

Enforce threat modeling and input validation to mitigate security vulnerabilities.

Community
Advanced
zhanglimaozhanglimao
23

security-logging-alerting-failures

Test and exploit security logging and alerting failures in applications.

Community
Advanced
ArabelaTsoArabelaTso
142

security-sensitive-path-instrumenter

Add structured logging to authentication, authorization, and input-handling code paths.

Community
Intermediate
belokonmbelokonm
8

security-engineer

Secure cloud infrastructure and CI/CD pipelines with security-by-design practices.

Community
Advanced