security-hardening
Skill5 starsChanged 47 days agoMITView on GitHub
use this when reviewing security, mapping trust boundaries, or hardening web, API, or agent changes — including LLD boundary gates, PR security review, auth, secrets, CORS, uploads, mesh binds, and skill intake.
25 other projects use a version of this.
Adopted by
Most recently taken up by
- valentinesamuel/claude-skillstheir own version, first seen Nov 8, 2026
- Mehul72/skillstheir own version, first seen Nov 8, 2026
- looties-io/looties-skillstheir own version, first seen Nov 1, 2026
- Kin9Zeus/senior-engineer-skillstheir own version, first seen Nov 1, 2026
- DevelopersGlobal/ai-agent-skillstheir own version, first seen Oct 25, 2026
- juanitourquiza/shipframetheir own version, first seen Oct 23, 2026
Used with
Projects with it also use coordinate, incident-response and 9 more.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
swyxioSkillcoordinate
Coordinate focused Luna helpers for bounded work and Astra advisers for difficult design questions while doing the main work yourself.
Also in 3 projects that use this
AnthropicSkillincident-response
Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.
Also in 5 projects that use this
OpenAISkillobservability
Vercel Observability expert guidance — Drains (logs, traces, speed insights, web analytics), Web Analytics, Speed Insights, runtime logs, custom events, OpenTelemetry integration, and monitoring dashboards. Use when instrumenting, debugging, or optimizing application performance and user experience on Vercel.
Also in 4 projects that use this
barisariburnuSkillperformance-optimization
Complete performance optimization guide for Next.js applications including frontend, backend, database, caching, and general optimization strategies. Use when improving performance, reducing bundle size, optimizing queries, or implementing caching.
Also in 4 projects that use this
GitHubSkillaccessibility-audit
Audits actual components and routes against applicable WCAG 2.2 A/AA criteria using consumer-owned design-system evidence and repository tools. Use when asked for an accessibility audit, a11y check, keyboard or focus review, contrast check, or screen-reader verification.
Also in 3 projects that use this
MicrosoftSkillapi-design
Guide for designing and documenting RESTful APIs. Use when asked to design an API, create endpoints, or document an API.
Also in 5 projects that use this
Other versions25 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 25
- duyet/clickhouse-monitoring★ 303same name
- DevelopersGlobal/ai-agent-skills★ 216same name
- swyxio/skills★ 194same name
- mn-youssef/security-skills★ 47same name
- wulaosiji/skills★ 28same name
- khuynh22/agent-dev-team★ 9same name
- juanitourquiza/shipframe★ 4same name
- jx1100370217/my-openclaw-skills★ 4same name
- thejordanleopold/claude-code-skills-distilled★ 4same name
- Kin9Zeus/senior-engineer-skills★ 3same name
15 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository49 other files it gives its agents.
- AGENTS.mdAGENTS.md
- maintainers/AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- buying-researcherSkill
- cursor-cloud-agents-whenSkill
- debug-anthropicSkill
- debug-pocockSkill
- debugSkill
- discover-the-ideaSkill
- docs-google-styleSkill
- golang-safetySkill
- golang-securitySkill
- golang-testingSkill
- grok-acpSkill
- host-config-pyinfraSkill
- lang-cppSkill
- lang-csharpSkill
- lang-cSkill
- lang-dartSkill
- lang-dockerSkill
- lang-goSkill
- lang-javaSkill
- lang-js-tsSkill
- lang-kotlinSkill
- lang-luaSkill
- lang-makefileSkill
- lang-phpSkill
- lang-powershellSkill
- lang-protobufSkill
- lang-pythonSkill
- lang-rubySkill
- lang-rustSkill
- lang-shellSkill
- lang-sqlSkill
- lang-swiftSkill
- lang-terraformSkill
- language-routerSkill
- lang-web-markupSkill
- modern-pythonSkill
- pr-reviewSkill
- sdlc-artifactsSkill
- sdlc-onboardingSkill
- shell-safetySkill
- tddSkill
- tracker-sdlcSkill
- ui-craftSkill
- ux-designSkill
- verify-before-doneSkill
- yagniSkill
The file
We split this skill into the rules it gives an agent
6 rules. 0 are common, 6 are distinctive, and 0 are very specific to this project.
0
Common
Most of the 22 edited versions we read keep these.
6
Distinctive
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- could be automatic: a setting could enforce it
- Distinctive: line 14
Do not treat the system prompt as a security boundary.
- Distinctive: line 31
If a change touches a boundary and skips a row, it fails the gate.
- Distinctive: line 46
Stop before you add or widen a topic in the table.
- Distinctive: line 49
Do not implement the widening in the same pass as an unrelated ticket.
- Distinctive: line 77
Leave the CI secret-scan and dependency-audit hooks to tester.
- Distinctive: line 85
Never add write, deploy, or credential tools to a skill that reviews, intakes, audits, or hardens, even “to finish the review.” Read, …
“Common” is measured: kept by at least 6 in 10 of the 22 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Security hardening
First-party Always / Ask first / Never rules for security and the SDLC. The table shape is inspired by Addy Osmani’s boundary pattern. This file is not a vendor copy.
The gate is the security check at LLD (trust boundaries) and at PR. security owns it.
Prompts are not a boundary
Do not treat the system prompt as a security boundary. Treat LLM output as untrusted.
Enforce authn/z, validation, egress, and data-class rules in code, policy, and infrastructure. Do not count prompt text, “be careful” instructions, or model self-reporting as controls. Treat tool calls, generated SQL/HTML/shell, and agent plans the same as untrusted client input.
Always
| Rule | Web | API | Agent |
| Validate at the trust boundary (schema, authn/z, size, type) | Form/query/body at the server, not only the browser | Every public and mesh-facing handler | Every tool argument and model-chosen action before it runs |
| Parameterized queries / safe data access | No string-built SQL or ORM raw with user text | Same; bind params on every store | Generated queries are untrusted; run only through parameterized paths |
| Encode output for the sink (HTML, URL, JSON, shell) | Contextual encode; CSP as defense in depth | Encode/escape at serialization boundaries | Never pass model text to eval, innerHTML, or a shell without a typed allowlist |
| HTTPS in transit | TLS for browsers and callbacks | TLS for clients and service-to-service | TLS for MCP/HTTP tools and callbacks |
| Hash passwords (slow, salted, dedicated KDF) | Login and session issuance | Token/password credential stores | Agent-held user secrets: do not invent a store; escalate |
| Security headers | CSP, HSTS, frame/referrer, nosniff as the app requires | Same on browser-facing responses | UI the agent emits still needs headers on the serving app |
| Secure cookies | Secure, HttpOnly, SameSite on session cookies | Cookie and token issuance APIs | Do not put session material in prompts or chat logs |
| Dependency audit before release | Lockfile + known-vuln scan in the release path | Same for API images and libs | Same for skill/tool packages; tester owns the hook |
If a change touches a boundary and skips a row, it fails the gate.
Ask first
| Topic | Why it is a stop | Typical surfaces |
| New auth | New principals, factors, or session shapes change the boundary | Login, magic links, API keys, service identity |
| New sensitive data classes | PII, payment, health, credentials, location need a class and retention story | New columns, logs, exports, agent memory |
| New integrations | New egress, new trust, new failure modes | OAuth apps, webhooks, MCP servers, vendors |
| CORS | Origin policy is a boundary; “* + credentials” is a vuln | Browser APIs, admin UIs |
| Uploads | Content type, size, storage, and execution risk | Avatars, CSV, skill zips, attachments |
| Rate limits | Missing limits are an abuse boundary | Public APIs, login, agent tool loops |
| Mesh / network binds | Who can reach the process is a trust boundary | Listen address, mesh expose, tunnel |
| Identity flows | Account linking, impersonation, and reset change who a principal is | SSO, invite, sudo, token exchange |
- Stop before you add or widen a topic in the table.
- Get a decision. On the LLD, the operator or security decides. Elsewhere, the operator decides.
- Record the decision on the LLD or the ticket.
- Do not implement the widening in the same pass as an unrelated ticket.
Never
| Never | Why | Web / API / agent |
| Secrets in git | Rotation theater; repo history is forever | Env files, .pem, tokens in SKILL.md, “example” keys that work |
| Logging tokens | Logs leak; agents paste logs | Auth headers, cookies, magic links, session IDs |
| Trust client validation | The client is the attacker | Browser-only checks, agent “I validated it” |
eval / innerHTML with user or model data | Injection | DOM sinks, eval, Function, shell eval |
Sessions in localStorage | XSS reads it | Prefer httpOnly cookies; do not stash session JWTs in web storage |
| Stack traces to clients | Layout and secrets leak | Prod 500 bodies, agent error relays to untrusted chat |
Public mesh / 0.0.0.0 binds | The network becomes the client | Dev servers, dashboards, agent runtimes on a public interface |
| Extra hosts / Windows outside the workspace without operator approval | Host lock | Do not target, remote, or “just use” a personal machine |
| Personal finance, mail, or password-manager access | Out of agent scope | No fetch, scrape, MCP, or “help me log in” |
Host and personal-account locks are Never, not Ask first. There is no “supervised exception” in this skill.
Roles
| Role | Owns | Does not own |
| security | The gate; skill intake per docs/INTAKE.md | Monthly vuln cadence; Monthly is not this gate |
| operator | Vuln severity calls, extra hosts, personal-account exceptions | Day-to-day intake scans |
| tester | CI secret-scan and dependency-audit hooks | Rewriting this skill or skipping security because CI is green |
| builder | Building behind the gate | Self-review as the security PR gate |
| manager | SDLC after-act | Approving a ship that skipped security |
Leave the CI secret-scan and dependency-audit hooks to tester; do not remint those jobs in this skill. A green CI hook is not a security clear. Escalate vulns to the operator. Never leave one in a “follow-up” with no ticket ID; name the ticket ID.
Workers (remote agents, local CLIs, mirrors) do not bypass security; the rule is in docs/SDLC.md Roles.
Review-skill discipline
Apply least privilege. Keep review skills read-only.
Never add write, deploy, or credential tools to a skill that reviews, intakes, audits, or hardens, even “to finish the review.” Read, report, and escalate instead. If the work needs a write, use a different skill and ask security separately.
Apply the same rule to this skill: use it as a gate only. Never use it as a pentest kit or a credentials broker, or as a reason to open bank, mail, or password stores.
Red flags
- “The system prompt already forbids that”
- “The model promised it would not”
- “Client-side validation is enough for this form”
- “It is only bound on
0.0.0.0in dev” - “I will audit dependencies after release”
- “Review will just fix the YAML / merge / rotate”
- “The extra host is convenient”
- “I need the password manager / mail / bank to verify”
Each of these fails the gate. Stop. Ask per Ask first, or treat it as Never. Do not ship.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.