Free Coding

Security Hardening skill

Build features safely: threat check first, then proven defences.

A Free skill. Sign-in opens soon.

By: Addy Osmani
Licence: MIT
Installs: 65.3K
Works in: 17 apps

Security and Hardening

Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

When to Use

Building anything that accepts user input

Implementing authentication or authorization

Storing or transmitting sensitive data

Integrating with external APIs or services

Adding file uploads, webhooks, or callbacks

Handling payment or PII data

Process: Threat Model First

Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker:

Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and LLM output — plus the local values that look internal because the OS handed them to you: another process's command line or environment, filenames on a shared volume, a path in a job payload. Trust follows who wrote a value, not which channel delivered it. Every boundary is attack surface.

Name the assets. What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement.

Run STRIDE over each boundary — a quick lens, not a ceremony:

Write abuse cases next to use cases. For each feature, ask "how would I misuse this?" — then make that your first test.

If you can't name the trust boundaries for a feature, you're not ready to secure it. This is OWASP A04: Insecure Design — most breaches begin in design, not code.

The Three-Tier Boundary System

No example output yet, so this is the start of the skill’s own instructions.

What Security Hardening makes

A security-first routine for web apps. Before adding hardening, it has the agent think like an attacker: where does untrusted data come in, what is worth protecting, and how could a feature be misused.

It then applies a three-tier rule set: always do, ask first, never do. Examples include checking all input, safe database queries, hashed passwords, security headers, safe cookies and a dependency audit before each release.

Best for: Developers building anything that takes user input, logins or personal data.

Threat model first, using the STRIDE checklist
Always / ask first / never do boundaries
Covers input, login, data storage and outside services
Dependency audit before release

Example prompts

Type something like this once the skill is added. Your app opens the skill when the request matches.

Check my login flow against the OWASP Top Ten
Harden this file upload endpoint
What should I review before adding payments?
Audit this input handler for vulnerabilities

What’s inside

3 files in the skill folder, with its MIT licence kept inside. Only text instructions and reference files, no program files.

SKILL.md the instructions
references/ 1 files
LICENSE licence

Which apps it works in

A skill is a folder of plain files, so any app that reads the open skills format can use it. Pick your app for its page.

How to add Security Hardening to your app

Step by step for each app. We say where to click, so you never need to leave this page.

ChatGPTby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Open the ChatGPT desktop app and look for Skills in the sidebar, where standalone skills are listed.
3 Add the “security-and-hardening” folder there if your version offers it. If you do not see Skills yet, use this skill in Claude or Codex instead.
4 In a chat, type @ and pick the skill, or just ask. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

To make your own, describe the workflow to @skill-creator in ChatGPT Work and it drafts a skill for you.

More ChatGPT skills

Claude appby Anthropic

1 Download the skill (.zip) with the button at the top of this page.
2 In the Claude app, open Settings > Features.
3 Upload the .zip file.
4 Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

The current Claude Help Center lists Free, Pro, Max, Team and Enterprise. Organization policy can restrict uploads and sharing. Chat runs code in an isolated environment; uploading a skill does not give it your local project, coding-agent tools or unrestricted network access.

More Claude app skills

Codexby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Codex and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Codex

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Codex skills

Claude Codeby Anthropic

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.claude/skills
3 Or paste the install prompt below into Claude Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Claude Code

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.claude/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: claude plugin marketplace add <owner/repo>

Built-in installer: claude plugin install <plugin>@<marketplace>

To use the skill in one project only, put it in .claude/skills inside that project instead.

More Claude Code skills

Cursor

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.cursor/skills
3 Or paste the install prompt below into Cursor and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Cursor

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.cursor/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .cursor/skills inside that project instead. Cursor also reads ~/.agents/skills, ~/.claude/skills, ~/.codex/skills.

More Cursor skills

GitHub Copilotby GitHub

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into GitHub Copilot and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into GitHub Copilot

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.copilot/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gh skill install <owner/repo> <skill> --agent github-copilot --scope user

To use the skill in one project only, put it in .github/skills inside that project instead. GitHub Copilot also reads ~/.agents/skills.

More GitHub Copilot skills

Gemini CLIby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.gemini/skills
3 Or paste the install prompt below into Gemini CLI and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Gemini CLI

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.gemini/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gemini skills install <git-url>

To use the skill in one project only, put it in .gemini/skills inside that project instead. Gemini CLI also reads ~/.agents/skills.

More Gemini CLI skills

Windsurf

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.codeium/windsurf/skills
3 Or paste the install prompt below into Windsurf and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Windsurf

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.codeium/windsurf/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .windsurf/skills inside that project instead.

More Windsurf skills

Kiro

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.kiro/skills
3 Or paste the install prompt below into Kiro and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Kiro

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.kiro/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .kiro/skills inside that project instead.

More Kiro skills

Antigravityby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.gemini/antigravity/skills
3 Or paste the install prompt below into Antigravity and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Antigravity

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.gemini/antigravity/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Antigravity skills

OpenCode

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.config/opencode/skills
3 Or paste the install prompt below into OpenCode and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into OpenCode

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.config/opencode/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .opencode/skills inside that project instead. OpenCode also reads ~/.agents/skills, ~/.claude/skills.

More OpenCode skills

Cline

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Cline and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Cline

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Cline skills

Amp

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.config/agents/skills
3 Or paste the install prompt below into Amp and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Amp

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.config/agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: amp skill add <github-url> --global

To use the skill in one project only, put it in .agents/skills inside that project instead. Amp also reads ~/.agents/skills, ~/.config/amp/skills, ~/.claude/skills.

More Amp skills

Gooseby Block

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Goose and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Goose

To use the skill in one project only, put it in .agents/skills inside that project instead. Goose also reads ~/.claude/skills.

More Goose skills

OpenClaw

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.openclaw/skills
3 Or paste the install prompt below into OpenClaw and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into OpenClaw

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.openclaw/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: openclaw skills install @owner/<slug>

Built-in installer: openclaw skills install @owner/<slug> --global

Built-in installer: openclaw skills install git:owner/repo@ref

To use the skill in one project only, put it in skills inside that project instead. OpenClaw also reads ~/.agents/skills.

More OpenClaw skills

Hermes Agentby Nous Research

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.hermes/skills
3 Or paste the install prompt below into Hermes Agent and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into Hermes Agent

I downloaded the agent skill "Security Hardening" as security-and-hardening.zip. Unzip it and copy the security-and-hardening folder into ~/.hermes/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: hermes skills install <owner/repo/skill>

More Hermes Agent skills

VS Codeby Microsoft

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-and-hardening” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into VS Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Check my login flow against the OWASP Top Ten”

Install prompt: paste this into VS Code

To use the skill in one project only, put it in .github/skills inside that project instead. VS Code also reads ~/.claude/skills, ~/.agents/skills.

More VS Code skills

Questions about Security Hardening

What is STRIDE?

A short checklist of six kinds of attack: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.

Does it ask me before big security changes?

Yes. Its ask-first list includes new login flows, new sensitive data and CORS changes.

Is the Security Hardening skill free?

Yes. It is a Free skill on Best Agent Skills. Sign-in opens soon; when it does, a free account is all you need to download it.

Who made the Security Hardening skill?

Addy Osmani. We did not write it. Best Agent Skills curates skills like this one, explains them in plain words and shows how to add them to your app. It is shared under the MIT licence (Copyright (c) 2025 Addy Osmani).

Security Hardening skill

What Security Hardening makes

Example prompts

What’s inside

Which apps it works in

How to add Security Hardening to your app

Questions about Security Hardening

Skills like Security Hardening