Security and Hardening
Makes the agent review and harden code against common web vulnerabilities using a threat-model-first approach.
- Repository
- addyosmani/agent-skills
- Stars
- 112,668
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent treats every external input as untrusted and checks code against common web security risks, such as injection, cross-site scripting, broken access control, weak authentication, and insecure file uploads. It starts by mapping where untrusted data enters a system and what is worth protecting, then applies a set of rules (for example, hashing passwords, using secure session cookies, and not leaking error details) and points to detailed code patterns in a reference file. It is a guide for the agent's reasoning and code changes rather than a security scanner.
Great for
- Developers building web apps with logins, forms, file uploads, or third-party integrations who want security considered from the start
- Teams reviewing an input handler, login flow, or API route against OWASP Top Ten risks
- Developers triaging package-manager audit findings or assessing a new dependency's supply-chain risk
Skip it if
- Replacing a professional penetration test or formal security audit, since the skill gives guidance and cannot guarantee code is secure (missed issues are possible)
- Non-web or highly specialised systems (for example embedded, cryptographic protocol design, or regulated payment processing) where the generic rules may not fit and expert review is needed
- Teams expecting automatic fixes across a whole codebase without reviewing changes, since security-sensitive edits such as auth logic should be approved by a human under the skill's own 'Ask First' rules
Try asking
- “Audit this Express login route for SQL injection, broken access control, and session cookie problems.”
- “Review this file upload handler and tell me what checks are missing before we ship it.”
- “Triage the vulnerabilities reported by npm audit and tell me which ones matter for our production build.”
- “Threat model our new webhook integration before I write the handler.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
security-and-hardening.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip security-and-hardening.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip security-and-hardening.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at a specific feature or file (for example a login handler) so it can apply the threat model to real trust boundaries.
- Ask for abuse cases first, then have the agent write tests for them, as the skill recommends.
- Review any changes to authentication, CORS, rate limiting, or file uploads yourself, since the skill itself requires human approval for these.
What's inside
- references/hardening-patterns.md
- SKILL.md
Redistributed unmodified from addyosmani/agent-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.