Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Security and Hardening

An OWASP-driven security review skill that hardens user input, auth, dependencies, and LLM features with concrete code patterns.

Security & ReviewIntermediate★ 422⑂ 44AI score 8/10Last updated: Sep 12, 2026

What it does

  • Threat model first: maps trust boundaries (HTTP requests, uploads, webhooks, LLM output, even another process's argv), runs a quick STRIDE pass, and turns abuse cases into your first tests.
  • Three-tier rule system: Always Do (validate input, parameterize queries, hash passwords, security headers), Ask First (new auth flows, CORS changes, file uploads), Never Do (commit secrets, log sensitive data, eval/innerHTML with user data).
  • OWASP Top 10 prevention patterns with TypeScript snippets for injection, broken auth, XSS, access control, misconfiguration, data exposure, and SSRF (including a private-IP resolution check).
  • Dependency & supply-chain triage: a decision tree for audit findings by severity and reachability, blocking install scripts, verifying signatures/provenance, spotting typosquats.
  • AI/LLM security & privacy: treat model output as untrusted, resist prompt injection, bound token/loop consumption, classify personal data, set retention and working deletion paths for GDPR/CCPA.
  • Review checklists and red flags for auth, authorization, input, data, infra, supply chain, and LLM usage.

Who it's for

  • Web developers (especially Node/TypeScript, Express, Next.js) doing self-review before shipping
  • Teams building login, sessions, payments, or anything touching PII
  • Engineers who need a defensible rule for when an audit finding blocks a release
  • Anyone adding chatbot/RAG features and worried about the new attack surface

Examples

  1. "Audit this login flow against the OWASP Top Ten" → checks cookie flags, rate limiting, hash cost, and whether errors leak internals.
  2. "npm audit shows three high findings — do I block the release?" → walks the decision tree on reachability, dev-only vs runtime, and fix availability, and records a review date for deferrals.
  3. "We fetch images from a user-supplied URL" → produces scheme/host allowlisting, private-IP rejection, redirect: 'error', plus the DNS-rebinding TOCTOU caveat.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/aiskillstore/marketplace/HEAD/pending/addyosmani/security-and-hardening/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the pending/addyosmani/security-and-hardening folder from the GitHub repo aiskillstore/marketplace into my ~/.claude/skills/security-and-hardening/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/aiskillstore/marketplace /tmp/aiskillstore && mkdir -p ~/.claude/skills/security-and-hardening && cp -r /tmp/aiskillstore/pending/addyosmani/security-and-hardening/* ~/.claude/skills/security-and-hardening/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Create the skills directory: mkdir -p ~/.claude/skills
  3. Clone the repository into a temp folder: git clone https://github.com/aiskillstore/marketplace /tmp/aiskillstore
  4. Copy the skill: cp -r /tmp/aiskillstore/pending/addyosmani/security-and-hardening ~/.claude/skills/
  5. If the repo ships references/security-checklist.md (referenced by the skill), copy it to ~/.claude/references/ so the links resolve.
  6. Verify: ls ~/.claude/skills/security-and-hardening/SKILL.md
  7. Restart Claude Code and ask something like "review this API route's input handling for vulnerabilities" to trigger the skill.
View source on GitHub ↗