skills.rest
sasidhar4444
sasidhar4444COMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP Top 10 vulnerabilities and supply-chain risks.

Updated Sep 8, 2026
Search Tags:#security#input validation#owasp#threat modeling#dependency audit#hardening#llm security
One-click install
npx skills add https://github.com/sasidhar4444/ai-receptionist --skill security-and-hardening-sasidhar4444
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/sasidhar4444/ai-receptionist/tree/main/agent-skills/skills/security-and-hardening
Command: npx skills add https://github.com/sasidhar4444/ai-receptionist --skill security-and-hardening-sasidhar4444

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a threat-model-first process and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE over each boundary before writing controls, with abuse cases written next to use cases. - OWASP Top 10 Prevention Patterns: Copy-ready TypeScript examples for parameterized queries, bcrypt password hashing, session cookie flags, CSP headers, CORS restriction, SSRF URL allowlisting, and Zod schema validation. - Dependency & Supply-Chain Triage: A decision tree for package-manager audit findings based on severity and reachability, plus lockfile integrity, install-script blocking, and typosquat detection. - AI/LLM Security Controls: Guidance mapped to the OWASP LLM Top 10 covering prompt injection, untrusted model output, tool permission scoping, and RAG tenant isolation. - Use Case: Before shipping a new login flow, run the security review checklist to verify password hashing, rate limiting with a shared store, session cookie flags, and authorization checks on every endpoint. ## Quick Start Ask the AI to audit your authentication endpoint and input handlers against the OWASP Top 10 using this security hardening skill.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Never interpolate user input directly into SQL strings.

How do I triage npm audit vulnerabilities?▼

Triage npm audit findings by severity and reachability: fix reachable critical and high issues immediately, schedule moderate production issues for the next release, and track low findings. Never run npm audit fix --force automatically; preview changes and read changelogs first.

What security headers should an Express app use?▼

Use the helmet middleware to set CSP, HSTS, X-Frame-Options, and X-Content-Type-Options headers. Configure a restrictive Content Security Policy with defaultSrc 'self' and restrict CORS to known origins rather than wildcard values.

How do I prevent SSRF when fetching user-supplied URLs?▼

Prevent SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. Be aware of the TOCTOU DNS-rebinding gap; for high-risk surfaces pin the resolved IP or use a filtering agent.

Why is rate limiting on login endpoints not working across servers?▼

In-memory rate limiters like express-rate-limit's default store keep counters per process, so the effective limit multiplies by instance count and resets on serverless invocations. Use a shared store such as Redis via rate-limit-redis or @upstash/ratelimit.

How do I secure LLM output in my application?▼

Treat all LLM output as untrusted input: never pass it to eval, SQL, shell commands, or innerHTML. Parse it defensively with a schema validator like Zod, run only allowlisted actions, and encode it before rendering, following the OWASP LLM Top 10.

Related Skills

Explore More Software Engineering Skills→
Mo7amed-MahmoudMo7amed-Mahmoud

threat_modeling

Identify assets, trust boundaries, and STRIDE threats into threat_model.md.

Community
Advanced
theodrosyimertheodrosyimer

npm-security

Audit npm, pnpm, or bun dependency security and recommend fix commands.

Community
Intermediate
rodolfochiconerodolfochicone
19

rc-observability

Guides production observability instrumentation, alerting, SLOs, and incident postmortems for services.

Community
Intermediate
MonumentalSystemsMonumentalSystems
17

vulnerability-scanning

Scan application code, dependencies, and container images for security vulnerabilities.

Official
Advanced