Description
security-and-hardening is an agent skill from Addy Osmani's agent-skills collection that brings security-first practices to web application development. It asks the agent to treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security is framed as a constraint on every line of code that touches user data, authentication or external systems, rather than a phase at the end of a project. The skill's process starts with a threat model. Controls added without one are described as guesses, so before hardening, the agent is asked to spend a few minutes thinking like an attacker. The skill applies when building anything that accepts user input, implementing authentication or authorization, storing or transmitting sensitive data, integrating with external APIs or services, adding file uploads, webhooks or callbacks, and handling payment or personal data. It is listed on skills.sh, with its security audit results shown there. The skill is a guide for how an agent should write code, not an audit tool, and it suits developers and agents who build features that handle user data and want the security reasoning built in from the start.…
Highlights
- Treats input, secrets and auth checks as critical
- Threat model before hardening
- Covers uploads, webhooks and payments
- Security as a constraint, not a final phase
Ratings & Reviews
No ratings yet
Be the first to rate security-and-hardening.
People also visit
defi-amm-security
Security checklist for Solidity AMM contracts, liquidity pools, and swap flows
django-security
Django security best practices, authentication, authorization, CSRF protection
enterprise-agent-ops
Operational controls for long-lived or cloud-hosted agent systems
security-and-hardening FAQ
What does the security-and-hardening skill do?
It guides an agent to write web application code with security-first practices, starting from a threat model.
How do I install it?
Run: npx skills add https://github.com/addyosmani/agent-skills --skill security-and-hardening
When should I use it?
When handling user input, authentication, sensitive data, external APIs, file uploads, webhooks, or payment and personal data.
Is it a security audit tool?
No. The skill guides how the agent writes and reasons about code. It is not described as an automated scanner.
What security checks has it passed?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best security-and-hardening alternatives?
Popular alternatives to security-and-hardening include healthcheck, defi-amm-security and django-security. See all security-and-hardening alternatives