security-and-hardening

security-and-hardening is an open-source security skill for Claude Code and compatible agents, published by addyosmani. Its author describes it as: “Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interact…”. The project has 88k stars on GitHub and is available under the MIT license. Add it to your setup with `/plugin marketplace add addyosmani/agent-skills`.

What security-and-hardening does

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

Installation

Add security-and-hardening to your agent with:

/plugin marketplace add addyosmani/agent-skills

Always review a skill's source before installing it. This command comes from the skill's public repository; the linked repo is the source of truth for exact setup steps.

What's inside

The SKILL.md for security-and-hardening is organised into these sections:

• Overview
• When to Use
• Process: Threat Model First
• The Three-Tier Boundary System
• Always Do (No Exceptions)
• Ask First (Requires Human Approval)
• Never Do
• OWASP Top 10 Prevention Patterns
• Injection (SQL, NoSQL, OS Command)
• Broken Authentication
• Cross-Site Scripting (XSS)
• Broken Access Control

When to use it

Reach for security-and-hardening when you want security help from your agent without writing the same instructions every session. Load the skill and the agent picks it up automatically for relevant tasks.

Strengths

• Clear MIT license — safe to read and adapt
• Ships in addyosmani/agent-skills, an established project with 88,280 GitHub stars
• Actively maintained (recent commits)

Topics

Frequently asked questions

What does security-and-hardening do?

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

How do I install security-and-hardening?

Run /plugin marketplace add addyosmani/agent-skills in your agent, then reload your skills. Review the source at https://github.com/addyosmani/agent-skills before installing.

Is security-and-hardening free to use?

Yes. security-and-hardening is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.

Where does security-and-hardening come from?

security-and-hardening ships inside addyosmani/agent-skills, a repository that contains 25 catalogued skills in total. The repository's 88,280 GitHub stars apply to that whole collection, not to this skill on its own.