— Skill

Addy Security & Hardening

Auth, input, and deps get bolted on last — this skill makes the agent map trust boundaries, OWASP risks, and supply-chain checks while the feature is still malleable.

What changes

Hardens features against common vulnerabilities: trust-boundary design, input/auth/session/storage checks, dependency/supply-chain audit, and privacy (GDPR/CCPA) when personal data is in play.

When

Use Addy Osmani’s security-and-hardening skill when the work touches untrusted input, authentication, sessions, data storage, third-party services, dependency risk, or personal data — and you need an agent to harden or audit against OWASP-class failures.

Good fits:

• Login / session / password-reset flows before launch.
• File upload or webhook handlers that accept untrusted payloads.
• Dependency audit triage after npm audit / similar noise.
• LLM/app features that add prompt-injection or data-exfil surface.

Skip it for general five-axis code quality (addy-code-review-and-quality), Cursor-only /review-security (cursor-pr-review), or runtime browser confirmation (addy-browser-testing-devtools).

How to start

Install with `npx skills add addyosmani/agent-skills --skill security-and-hardening`. Point at the feature paths; require named trust boundaries and checklist coverage before sign-off.

Use the security-and-hardening skill on [paths / feature].
First: name trust boundaries (who is trusted, what crosses the boundary).
Then audit: input validation, auth/session, storage/secrets, deps/supply chain, headers/CORS,
and privacy if PII is involved. Map to OWASP where relevant.
For each finding: severity, file path, fix pattern. No invented compliance certifications.
Do not claim “production ready” without a human sign-off checklist.