Overview
security-and-hardening is an open-source security skill for Claude Code and compatible agents, published by addyosmani. Its author describes it as: “Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe aga…”. The project has 98k stars on GitHub and is available under the MIT license. Add it to your setup with `/plugin marketplace add addyosmani/agent-skills`.
What security-and-hardening does
Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.
What’s inside
The SKILL.md for security-and-hardening is organised into these sections:
- Overview
- When to Use
- Process: Threat Model First
- The Three-Tier Boundary System
- Always Do (No Exceptions)
- Ask First (Requires Human Approval)
- Never Do
- Hardening Controls
- Injection, XSS, and access control
- Authentication and sessions
- Headers, CORS, and responses
- Input validation and uploads
Installation
Add security-and-hardening to your agent with:
/plugin marketplace add addyosmani/agent-skillsReview a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.
Supported agents
- Claude Code — ships a claude code plugin marketplace
- Codex — declared in the repository topics
- Cursor — declared in the repository topics
- Antigravity — declared in the repository topics
License
security-and-hardening is published under the MIT license.
Strengths
- Clear MIT license — safe to read and adapt within its terms
- Ships in addyosmani/agent-skills, an established project with 97,992 GitHub stars
- Works with Claude Code, Codex, Cursor, Antigravity
- Actively maintained — repository updated in the last 30 days
- Its repository gained 16,916 GitHub stars over the last 52 days
Author
Topics
Alternatives to security-and-hardening
Similar skills from other repositories:
Frequently asked questions
- What does security-and-hardening do?
- Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
- How do I install security-and-hardening?
- Run /plugin marketplace add addyosmani/agent-skills in your agent, then reload your skills. Review the source at https://github.com/addyosmani/agent-skills before installing.
- Is security-and-hardening free to use?
- Yes. security-and-hardening is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.
- Which agents does security-and-hardening work with?
- security-and-hardening lists Claude Code, Codex, Cursor, and Antigravity — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
- Where does security-and-hardening come from?
- security-and-hardening ships inside addyosmani/agent-skills, a repository that contains 26 catalogued skills in total. The repository's 97,992 GitHub stars apply to that whole collection, not to this skill on its own.
