skills.rest
DagimAlemayehuu
DagimAlemayehuuCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated Jul 19, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/DagimAlemayehuu/AgenticEngineering --skill security-and-hardening-dagimalemayehuu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/DagimAlemayehuu/AgenticEngineering/tree/main/agentic-engineering/core/dependencies/security/security-and-hardening
Command: npx skills add https://github.com/DagimAlemayehuu/AgenticEngineering --skill security-and-hardening-dagimalemayehuu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured security workflow so these risks are addressed during development rather than retrofitted after a breach. ## Core Features & Use Cases - Threat Modeling First: Maps trust boundaries and applies STRIDE analysis before writing controls, preventing insecure design (OWASP A04). - Three-Tier Boundary System: Defines Always Do rules (parameterized queries, output encoding, bcrypt hashing, security headers), Ask First gates (auth changes, new PII storage, CORS changes), and Never Do prohibitions (committed secrets, eval with user data). - OWASP Prevention Patterns: Provides TypeScript code examples for injection, broken authentication, XSS, access control, misconfiguration, SSRF, and LLM-specific risks (prompt injection, untrusted model output). - Supply-Chain Hygiene: Guides lockfile verification, dependency audit triage by reachability, and blocking unreviewed install scripts. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern with DNS resolution checks to block requests to internal services like cloud metadata endpoints. ## Quick Start Use the security-and-hardening skill to review my new API endpoint for vulnerabilities before I commit it.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query methods.

How do I protect a server from SSRF attacks on webhook URLs?▼

Protect against SSRF by allowlisting schemes and hostnames, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. For high-risk surfaces, pin the resolved IP or use a filtering agent to close the DNS-rebinding TOCTOU gap.

What session cookie settings should I use for authentication?▼

Use httpOnly, secure, and sameSite cookie attributes for session tokens, with secrets loaded from environment variables rather than code. Hash passwords with bcrypt, scrypt, or argon2 at 12 or more salt rounds, and apply rate limiting to login endpoints.

How should I handle LLM output in my application securely?▼

Treat all LLM output as untrusted input: never pass it into eval, SQL, shells, or innerHTML. Parse it defensively with schema validation, encode it before rendering, keep secrets out of prompts, and scope tool permissions with confirmation for destructive actions.

When should I fix vulnerabilities reported by npm audit?▼

Triage audit findings by severity and reachability: fix reachable critical or high vulnerabilities immediately, schedule moderate production issues for the next release, and track low-severity items. Never apply forced fixes automatically; review changelogs and test each upgrade.

Related Skills

Explore More Software Engineering Skills→
yknothingyknothing
1

security-design

Codify security boundaries, threat models, and controls per architectural layer.

Community
Advanced
diShine-digital-agencydiShine-digital-agency
1

shine-deploy-checklist

Generate a staged deployment checklist covering tests, migrations, flags, and observability.

Community
Advanced
pwarnockpwarnock
2

security-scanning

Automates security scanning for vulnerabilities, secrets, and misconfigurations in projects.

Community
Advanced
DoumajnikDoumajnik
3

security-hardening

Audit web and cloud-native services for OWASP Top 10 2021 compliance.

Community
Advanced