skills.rest
rizqinrr
rizqinrrCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities, SSRF, and supply-chain risks.

665|3|Updated Sep 12, 2026
Search Tags:#security#authentication#owasp#threat modeling#dependency audit#hardening#ssrf
One-click install
npx skills add https://github.com/rizqinrr/viserys-agent --skill security-and-hardening-rizqinrr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/rizqinrr/viserys-agent/tree/main/skills/security-and-hardening
Command: npx skills add https://github.com/rizqinrr/viserys-agent --skill security-and-hardening-rizqinrr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Code that handles user input, authentication, or external integrations often ships with exploitable vulnerabilities because security checks are applied inconsistently or bolted on too late. This Skill provides a threat-model-first workflow with concrete prevention patterns, checklists, and verification steps so security becomes a constraint on every line of code rather than an afterthought. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run a lightweight STRIDE analysis before writing controls, so mitigations target real attack surface instead of guesses. - OWASP Prevention Patterns: Ready-to-use TypeScript examples for injection, broken authentication, XSS, broken access control, security misconfiguration, sensitive data exposure, and SSRF, plus input validation with Zod and safe file upload handling. - Dependency and Supply-Chain Triage: A decision tree for package-manager audit findings based on severity and reachability, plus lockfile integrity, install-script blocking, and typosquat detection guidance. - Privacy and LLM Security: Data classification, retention, and deletion-path rules for GDPR/CCPA compliance, and OWASP LLM Top 10 guidance for treating model output as untrusted input. - Use Case: While building a login flow, apply the Skill to hash passwords with bcrypt, configure httpOnly/secure/sameSite session cookies, add rate limiting backed by a shared store, and run the security review checklist before shipping. ## Quick Start Audit this authentication endpoint for OWASP Top 10 vulnerabilities and tell me what to fix before release.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in a Node.js API?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Validate all external input at the route boundary with a schema validator like Zod before it reaches the query layer.

How do I triage npm audit vulnerabilities?▼

Triage audit findings by severity and reachability: fix reachable critical or high findings immediately, schedule moderate production-reachable ones for the next release, and track low findings for routine updates. Never run npm audit fix --force blindly; preview changes, read changelogs, and document any deferred fix with a review date.

How do I prevent SSRF when fetching user-supplied URLs?▼

Prevent SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP, and disabling redirects. The check has a TOCTOU gap since fetch re-resolves DNS, so for high-risk surfaces pin the resolved IP or use a filtering agent like request-filtering-agent.

Does express-rate-limit work behind a load balancer?▼

No, express-rate-limit keeps counters in process memory by default, so each instance counts separately and the effective limit multiplies by instance count. Use a shared store such as Redis via rate-limit-redis, or an HTTP-based limiter like @upstash/ratelimit for serverless environments.

How should I handle LLM output in my application securely?▼

Treat all LLM output as untrusted input: never pass it into eval, SQL, a shell, or innerHTML. Parse it defensively with JSON.parse and a schema validator, run only allowlisted actions, and encode it before rendering, following the OWASP Top 10 for LLM Applications.

What should I do if a secret was committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not enough once it reaches a remote. After rotation, purge it from history and add .env patterns to .gitignore to prevent recurrence.

Related Skills

Explore More Software Engineering Skills→
prapanchprapanch

threat-modeling

Enumerate threats with STRIDE and map components, data flows, and trust boundaries.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

recon-exposed-devtools

Detect exposed developer tools, debug interfaces, and source-map files on web applications.

Community
Advanced
mpsuessermpsuesser
22

effect-wide-events

Design span attributes for queryable wide event instrumentation.

Community
Intermediate
orqesaorqesa

build_vs_buy

Evaluate build versus buy options for software capabilities.

Official
Intermediate