skills.rest
SJLee-0525
SJLee-0525COMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Hardens web application code against injection, XSS, SSRF, and supply-chain vulnerabilities.

Updated Jul 1, 2026
Search Tags:#security#authentication#owasp#threat modeling#dependency audit#hardening#ssrf
One-click install
npx skills add https://github.com/SJLee-0525/aperture --skill security-and-hardening-sjlee-0525
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/SJLee-0525/aperture/tree/main/.claude/skills/security-and-hardening
Command: npx skills add https://github.com/SJLee-0525/aperture --skill security-and-hardening-sjlee-0525

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a threat-model-first workflow and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE over each boundary before writing controls, addressing OWASP A04 insecure design. - OWASP Prevention Patterns: Ready-to-use TypeScript code for parameterized queries, bcrypt password hashing, secure session cookies, CSP headers, schema validation with zod, file upload restrictions, and SSRF URL allowlisting with DNS resolution checks. - Supply-Chain and Dependency Triage: A decision tree for triaging audit findings by severity and reachability, plus rules for lockfile integrity, blocking unreviewed install scripts, and reviewing new dependencies. - Privacy and LLM Security: Data classification, retention, and deletion guidance for GDPR/CCPA compliance, plus OWASP LLM Top 10 mitigations for prompt injection, untrusted model output, and excessive agency. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF pattern to allowlist hosts, reject private IPs, and disable redirects before shipping. ## Quick Start Ask the AI to review your new API endpoint or authentication flow using the security-and-hardening checklist and fix any violations it finds.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query with placeholder parameters or an ORM like Prisma. Never interpolate user input directly into SQL strings.

How do I secure session cookies against XSS and CSRF?▼

Set session cookies with httpOnly to block JavaScript access, secure to require HTTPS, and sameSite to mitigate CSRF. Hash passwords with bcrypt at 12 or more salt rounds and keep session secrets in environment variables.

How do I prevent SSRF when fetching user-supplied URLs?▼

Prevent SSRF by allowlisting schemes and hostnames, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. For high-risk surfaces, pin the resolved IP or use a filtering agent to close the DNS-rebinding TOCTOU gap.

Should I run npm audit fix --force to resolve vulnerabilities?▼

No, forced audit fixes can cross declared dependency ranges and break your application. Triage findings by severity and reachability, preview remediations, read changelogs, and test each upgrade individually.

How do I secure LLM output in a chatbot or RAG feature?▼

Treat all model output as untrusted input: never pass it into eval, SQL, shells, or innerHTML. Parse and validate it against a schema, encode it before rendering, keep secrets out of prompts, and scope tool permissions with confirmation for destructive actions.

What are the limitations of dependency audit tools?▼

Audits only match known advisories and cannot detect newly malicious or typosquatted packages. Combine audits with lockfile integrity checks, blocking unreviewed install scripts, signature verification, and manual review of new dependencies.

Related Skills

Explore More Software Engineering Skills→
YSheldonYSheldon

threat_modeling

Generate a formal threat_model.md by enumerating assets, trust boundaries, and STRIDE categories.

Community
Advanced
tannergoldentannergolden

Operator

Automate system operations oversight and incident response workflows.

Community
Advanced
ArabelaTsoArabelaTso
142

security-sensitive-path-instrumenter

Add structured logging to authentication, authorization, and input-handling code paths.

Community
Intermediate
masermediagroup-stackmasermediagroup-stack
1

administering-linux

Manage Linux servers covering systemd services, filesystems, networking, security hardening, and performance tuning.

Community
Advanced