security-and-hardening

An agent skill by addyosmani, from addyosmani/agent-skills. Tags: api, debugging, developer-tools, web.

What it does

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add addyosmani/agent-skills --skill security-and-hardening

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/addyosmani/agent-skills
cp -r agent-skills/skills/security-and-hardening ~/.claude/skills/security-and-hardening

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only: two readable Markdown files with security guidance and code examples, and no executable scripts or installers. It does not directly touch the machine, network, files, or credentials; the main consideration is simply that it encourages an agent to reason about sensitive topics like secrets, SSRF, and LLM prompt handling.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No scripts, binaries, or code that would execute on install; only Markdown guidance and fenced examples in `SKILL.md` and `references/hardening-patterns.md`.
Network access	0 (none)	It describes secure network patterns such as HTTPS and SSRF defenses, but does not itself fetch from or send data to any remote host.
Filesystem reach	0 (none)	There are no commands or routines that read, write, or delete files outside the project; the only paths are documentation references.
Secrets & credentials	0 (none)	It discusses secret handling (`.env`, `process.env.SESSION_SECRET`, `STRIPE_API_KEY`) as guidance, but does not access or request actual secrets.
Privilege & persistence	0 (none)	No sudo, service registration, shell startup edits, or OS-level configuration changes are present.
Instruction hijack surface	0 (none)	The text warns about prompt injection and system prompts as security concepts, but it does not instruct the agent to ignore rules, hide things, or follow external instructions.
Irreversible actions	0 (none)	There is no capability to deploy, publish, send messages, or perform other external actions; this is a review/hardening guide only.
Transparency	0 (none)	All shipped content is plain text Markdown; there are no binaries, decoded blobs, or unreviewable installers.

Before installing

No install step is needed; just read `SKILL.md` and `references/hardening-patterns.md` to confirm it is documentation-only.
If you plan to use the guidance in production, verify the linked external references (`../../references/security-checklist.md`) exist in your workspace and match your stack.
Apply the checklist in a scratch branch first if you want to adopt the patterns for auth, SSRF, or dependency auditing.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: addyosmani/agent-skills (all skills from this repository)
Path: skills/security-and-hardening/SKILL.md
Branch: main
Updated: 2026-09-19

debugging-and-error-recovery — Guides systematic root-cause debugging.
observability-and-instrumentation — Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting.
performance-optimization — Optimizes application performance across frontend, backend, queries, and databases.
systematic-debugging — Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
browser-testing-with-devtools — Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser.
deprecation-and-migration — Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another.