skills.rest
assafmanor
assafmanorCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities, SSRF, and supply-chain risks.

Updated Jul 9, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/assafmanor/waypoint --skill security-and-hardening-assafmanor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/assafmanor/waypoint/tree/main/.claude/skills/security-and-hardening
Command: npx skills add https://github.com/assafmanor/waypoint --skill security-and-hardening-assafmanor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a threat-model-first process and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE over each boundary before writing controls, with abuse cases written next to use cases. - OWASP Prevention Patterns: Ready-to-use TypeScript code for parameterized queries, bcrypt password hashing, secure session cookies, CSP headers via helmet, Zod schema validation, and SSRF-safe URL fetching with DNS resolution checks. - Supply-Chain & Dependency Triage: A decision tree for triaging audit results by severity and reachability, plus rules for lockfile integrity, blocking dependency install scripts, and reviewing new packages for typosquats. - Privacy & LLM Security: Data classification, retention, and deletion-path guidance for GDPR/CCPA, plus OWASP LLM Top 10 rules for treating model output as untrusted input. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern that validates scheme, host, and resolved IPs before fetching. ## Quick Start Ask the AI to review your new API endpoint or authentication flow using the security-and-hardening checklist and fix any violations it finds.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Never interpolate user input directly into SQL strings.

How do I prevent SSRF when fetching user-supplied URLs?▼

Prevent SSRF by allowlisting the scheme and hostname, resolving all DNS records and rejecting any private or reserved IP range, and disabling redirects. Note the remaining TOCTOU gap: for high-risk surfaces, pin the resolved IP or use a filtering agent like request-filtering-agent.

What session cookie settings should I use for authentication?▼

Use httpOnly, secure, and sameSite cookies for sessions, with secrets loaded from environment variables rather than code. Hash passwords with bcrypt, scrypt, or argon2 at 12 or more salt rounds, and apply stricter rate limiting to authentication endpoints.

How should I triage npm audit vulnerability results?▼

Triage audit results by severity and reachability: fix reachable critical or high findings immediately, schedule moderate production-reachable ones for the next release, and track low findings. Never run npm audit fix --force automatically; preview changes, read changelogs, and test each upgrade.

Is it safe to pass LLM output into SQL queries or HTML?▼

No, LLM output must be treated as untrusted input. Never pass it into eval, SQL, shell commands, or innerHTML; instead parse it defensively, validate it against a schema, and encode it before rendering, since prompt injection can turn model output into an attack vector.

What should I do if a secret is committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not enough once it reaches a remote. After rotation, purge it from history and add env files and key files to gitignore.

Related Skills

Explore More Software Engineering Skills→
BorisserzBorisserz
1

security-and-hardening

Enforce threat modeling and input validation to mitigate security vulnerabilities.

Community
Advanced
theodrosyimertheodrosyimer

npm-security

Audit npm, pnpm, or bun dependency security and recommend fix commands.

Community
Intermediate
ArabelaTsoArabelaTso
142

security-sensitive-path-instrumenter

Add structured logging to authentication, authorization, and input-handling code paths.

Community
Intermediate
Timmy6942025Timmy6942025

security-reviewer

Scans code and systems for vulnerabilities and generates risk reports.

Community
Advanced