Security & hardening
Input validation, authn/authz, secrets, dependency risk and logging — the everyday floor rather than a formal audit.
Installation
$ npx skills add addyosmani/agent-skillsThe CLI's unit is the repository, so this installs everything in addyosmani/agent-skills, not security-and-hardening alone. It writes into whichever agent directories it finds — Claude Code, Codex, Cursor, Copilot, Windsurf, Zed.
Summary
Input validation, authn/authz, secrets, dependency risk and logging — the everyday floor rather than a formal audit.
- Reach for it when the baseline you want loaded on any change that touches user input or credentials.
- Sits in Secure — threat modelling, scanning, supply chain, and finding the other five copies of the bug you just found.
- Stack-agnostic — nothing in it assumes a particular language or framework.
- Published by Addy Osmani. Well regarded, but not the vendor of the thing it covers.
- Installing pulls the whole addyosmani/agent-skills repository: this catalogue lists 19 other entries from it, and the repo may hold more.
Where it sits in delivery
SecureThreat modelling, scanning, supply chain, and finding the other five copies of the bug you just found.Everything in Secure →
The skill itself
The full text lives with its publisher and changes when they change it. Read it there rather than here — a mirrored copy of somebody else's procedure goes stale silently, and this page would have no way of telling you.
Related
More in Secure
- Security best practicesOpenAI's secure-coding guidance for agent-written code.
openai/skills - Supabase Postgres best practicesSchema, indexing and row-level security as Supabase recommends them.
supabase/agent-skills - CodeQLWriting and running CodeQL queries for dataflow problems a pattern matcher cannot see.
trailofbits/skills - Secure workflow guideHardening CI: pinned actions, scoped tokens, and the injection paths in a pull_request_target trigger.
trailofbits/skills - SemgrepRunning Semgrep properly and writing rules that catch a pattern without drowning the repo in findings.
trailofbits/skills - Security threat modelProduces a threat model for a feature or system — assets, entry points, trust boundaries, mitigations.Agent
openai/skills