skills.rest
Arete-Consortium
Arete-ConsortiumOFFICIAL
Explore all skills by this author →
GitHub

web-security-hardener

Configures security headers, CSP policies, CORS, and input validation for web applications.

4|2|Updated Jan 27, 2026
Search Tags:#input validation#owasp#security headers#csp#web security#cors#dependency audit
One-click install
npx skills add https://github.com/Arete-Consortium/ai-skills --skill web-security-hardener-arete-consortium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-security-hardener
Source: https://github.com/Arete-Consortium/ai-skills/tree/main/personas/web/web-security-hardener
Command: npx skills add https://github.com/Arete-Consortium/ai-skills --skill web-security-hardener-arete-consortium

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications ship with insecure defaults — missing security headers, permissive CORS, weak CSP, and vulnerable dependencies — leaving them exposed to OWASP Top 10 attacks like XSS, CSRF, and injection. ## Core Features & Use Cases - Security Headers Audit: Scans current HTTP headers, identifies missing or misconfigured ones, and generates a recommended configuration block with implementation guidance for middleware, vercel.json, or nginx. - CSP Design: Builds Content Security Policies starting in Report-Only mode, with a staged migration plan to full enforcement based on violation reports. - Input Validation & Dependency Auditing: Implements server-side validation, output sanitization, and runs npm audit / pip-audit / cargo audit with CVSS-prioritized remediation. - Use Case: Before launching a new web app, ask for a headers audit and CSP configuration to get a complete hardening plan verified against Mozilla Observatory. ## Quick Start Ask the assistant to audit the security headers for your domain and generate a hardened configuration with a Content Security Policy.

Frequently Asked Questions about web-security-hardener

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure security headers for my website?▼

Audit current headers with curl -I or securityheaders.com, then add Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Implement them in middleware, vercel.json, or nginx.conf and verify with Mozilla Observatory.

How to set up a Content Security Policy without breaking my site?▼

Deploy the policy first as Content-Security-Policy-Report-Only, monitor violation reports for about a week, add missing sources to the allowlist, then switch to enforcing mode. Use nonces or hashes for inline scripts instead of unsafe-inline.

Can I use Access-Control-Allow-Origin wildcard with credentials?▼

No. Combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true lets any site make authenticated requests on behalf of your users. Specify an explicit origin like https://app.example.com when credentials are required.

What cookie attributes prevent XSS and CSRF attacks?▼

Set HttpOnly to block JavaScript access, Secure to restrict cookies to HTTPS, and SameSite=Lax or Strict for CSRF mitigation. Also define Path, Max-Age, and Domain to scope the cookie appropriately.

When should I use a full security audit instead of web hardening?▼

Use a broader security-auditor approach when you need threat modeling or penetration testing scope across all application types. Web security hardening covers only the application layer: headers, CSP, CORS, input validation, and dependency audits.

Related Skills

Explore More Software Engineering Skills→
grvpanchalgrvpanchal
1

server-protocol

Configure HTTPS/TLS settings, security headers, and certificate lifecycles for web deployments.

Community
Advanced
ozan-fnozan-fn

golang-dependency-management

Manage Go dependencies in go.mod and go.sum files with vulnerability scanning.

Community
Advanced
claudcherejiclaudchereji

database-administrator

Administer PostgreSQL, MySQL, MongoDB, and Redis databases for high availability and performance.

Community
Advanced
efiadmefiadm

senior-security

Audit codebases for security vulnerabilities and misconfigurations.

Community
Advanced