skills.rest
sabiscore
sabiscoreCOMMUNITY
Explore all skills by this author →
GitHub

security-hardening-auditor

Audits and hardens Next.js and Node.js applications against OWASP Top 10 vulnerabilities.

1|Updated Sep 3, 2026
Search Tags:#OWASP#input validation#rate limiting#Next.js#security audit#auth.js#csp headers
One-click install
npx skills add https://github.com/sabiscore/the-yap-engine --skill security-hardening-auditor-sabiscore
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hardening-auditor
Source: https://github.com/sabiscore/the-yap-engine/tree/main/.ai/skills/security-hardening-auditor
Command: npx skills add https://github.com/sabiscore/the-yap-engine --skill security-hardening-auditor-sabiscore

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires next-auth, @auth/prisma-adapter, bcryptjs, zod, @upstash/ratelimit, @upstash/redis, @fastify/rate-limit, @t3-oss/env-nextjs.

What problem does it solve? Full-stack applications ship with authentication gaps, missing security headers, unvalidated inputs, and injection risks that lead to breaches. This Skill audits existing code against the OWASP Top 10 and generates production-grade security configurations so vulnerabilities are found and fixed before deployment. ## Core Features & Use Cases - OWASP Top 10 Audit: Walks all ten categories (broken access control, injection, misconfiguration, SSRF, and more) and produces a severity-rated findings report with root cause and remediation for each issue. - Auth.js v5 Setup: Generates complete authentication with NextAuth v5, including Google and Credentials providers, bcrypt password hashing, JWT session callbacks, and edge middleware route protection. - Defense Configuration: Produces Content Security Policy and security headers, tiered rate limiting with Upstash Redis or Fastify, Zod input validation schemas, parameterized Prisma queries, and startup-time secrets validation. - Use Case: Before launching a SaaS app, ask for a security audit. The Skill flags a missing ownership check on invoice fetches, absent rate limiting on login endpoints, and a weak CSP, then outputs the exact code to fix each finding. ## Quick Start Ask the AI to audit your Next.js application for security vulnerabilities and generate the fixes for any critical findings.

Frequently Asked Questions about security-hardening-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up Auth.js v5 authentication in Next.js?▼

Install next-auth@beta and create an auth.ts file exporting handlers, signIn, signOut, and auth. Configure providers like Google and Credentials, use a JWT session strategy, and embed user id and role in the token via jwt and session callbacks.

How to add rate limiting to a Next.js or Fastify API?▼

Use @upstash/ratelimit with @upstash/redis for serverless Next.js routes, applying sliding window limiters such as 5 attempts per 15 minutes on auth endpoints. For Fastify, register @fastify/rate-limit with a max count and time window.

Does Prisma prevent SQL injection by default?▼

Prisma parameterizes all standard queries automatically, so methods like findUnique are safe. Raw queries must use tagged template literals with $queryRaw; never pass user input into $queryRawUnsafe via string concatenation.

What security headers should a Next.js app have?▼

Set X-Frame-Options to DENY, X-Content-Type-Options to nosniff, Strict-Transport-Security with a one-year max-age, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy. Configure them in next.config.ts and verify with securityheaders.com.

Why does bcrypt password validation fail with long passwords?▼

bcrypt truncates input beyond 72 characters, so passwords must be validated with a maximum length of 72 before hashing. Use Zod to enforce min(8).max(72) and hash with at least 12 salt rounds.

How do I validate environment variables and secrets in Node.js?▼

Use @t3-oss/env-nextjs with Zod to define required server and client variables, then import the validated env object instead of process.env. The app throws at startup if any required secret like DATABASE_URL or AUTH_SECRET is missing.

Related Skills

Explore More Software Engineering Skills→
abdoulayesowabdoulayesow

/seri-api

Generate Next.js API routes with Prisma, Neon PostgreSQL, and JWT auth.

Community
Advanced
LucasSantana-DevLucasSantana-Dev
17

e2e-playwright

Execute and write Playwright end-to-end tests for web applications.

Community
Intermediate
whitebearditwhitebeardit
12

opentelemetry-instrumentation

Instrument Node.js and TypeScript applications with OpenTelemetry spans for distributed tracing.

Official
Advanced
HassanRJ-3108HassanRJ-3108

auth-skill

Implement user signup, signin, password hashing, and JWT verification.

Community
Advanced