skills.rest
nicorevo
nicorevoCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated May 21, 2026
Search Tags:#security#input validation#owasp#threat modeling#dependency audit#ssrf#llm security
One-click install
npx skills add https://github.com/nicorevo/AI-SDLC-Template --skill security-and-hardening-nicorevo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/nicorevo/AI-SDLC-Template/tree/main/.opencode/skills/security-and-hardening
Command: npx skills add https://github.com/nicorevo/AI-SDLC-Template --skill security-and-hardening-nicorevo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill gives an AI agent a structured, threat-model-first process to identify trust boundaries and apply concrete prevention patterns before vulnerabilities ship. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE over each boundary before writing controls, addressing OWASP A04 Insecure Design. - OWASP Prevention Patterns: Ready-to-use TypeScript code for parameterized queries, bcrypt password hashing, secure session cookies, CSP headers via helmet, Zod schema validation, and SSRF-safe URL fetching with DNS resolution checks. - Supply-Chain and Dependency Auditing: A decision tree for triaging native package-manager audit results by severity and reachability, plus lockfile and install-script hygiene rules. - LLM Security Controls: Guidance mapped to the OWASP LLM Top 10 for treating model output as untrusted input, constraining tool permissions, and isolating RAG data per tenant. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern to block requests to internal IPs like the cloud metadata service. ## Quick Start Ask the agent to review the new authentication and file upload endpoints for security vulnerabilities using the security-and-hardening checklist.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Never interpolate user input directly into query strings.

How to secure Express apps with security headers?▼

Use the helmet middleware to set security headers including Content Security Policy, HSTS, X-Frame-Options, and X-Content-Type-Options. Configure CSP directives to restrict script and style sources, and limit CORS to known origins rather than wildcards.

What is SSRF and how do I prevent it?▼

SSRF occurs when a server fetches a user-influenced URL, letting attackers reach internal services like cloud metadata endpoints. Prevent it with an allowlist of hosts, HTTPS-only enforcement, DNS resolution checks rejecting private IP ranges, and disabled redirects.

How should I triage npm audit vulnerability reports?▼

Triage audit findings by severity and reachability: fix reachable critical or high issues immediately, schedule moderate production issues for the next release, and track low findings. Never run forced automatic fixes, and document deferred items with a review date.

Can LLM output be a security risk in my application?▼

Yes, LLM output is untrusted input that can contain SQL, script tags, or shell commands. Never pass it to eval, innerHTML, or database queries; instead parse it defensively, validate against a schema, and encode it before rendering.

When should security changes require human approval?▼

Human approval is required before adding authentication flows, storing new sensitive data categories, integrating external services, changing CORS or rate limiting, adding file upload handlers, or granting elevated permissions. Routine validation and encoding fixes need no approval.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
swyxioswyxio
154

autoreview

Run structured closeout code reviews on branches, PRs, and commits.

Community
Advanced
jayjpatel9717jayjpatel9717

api-security

Test API security for authentication, authorization, input validation, and rate limiting.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced