security-and-hardening: a Claude Code skill by Addy Osmani

For web developers handling input, logins or personal data who want clear always, ask-first and never rules. Skip it if you need a formal audit report.

Copy install command View the source

Score: 77of 100
Rank: #87of 239
Installs: 82.7Kon skills.sh
Security: Mixed 5 scanners
Updated: Nov 12026
Context: ~155tokens always

Install

npx skills add https://github.com/addyosmani/agent-skills --skill security-and-hardening

Run it in your terminal. View the source

Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app

What does security-and-hardening do?

security-and-hardening is a Claude skill that applies security rules while Claude writes web code. It starts with a short threat model: map the trust boundaries, name the assets, and run STRIDE over each boundary. Rules come in three tiers. Always validate input, use parameterized queries, hash passwords and set CSP and HSTS headers. Ask first before new auth flows, CORS changes or upload handlers. Never commit secrets or pass user data to eval or innerHTML. Further sections cover SSRF, rate limits, GDPR and CCPA privacy, LLM output, and dependency audits run against the lockfile with install scripts blocked. A verification checklist closes it.

When should you use security-and-hardening?

Use it when

Adding a login, session or file upload feature
Triaging npm audit or other package audit findings
Handling personal data that falls under GDPR

Skip it when

You need a full audit with findings files
Your code never touches user input or secrets

What it needs and what it can touch

What it can do

Reads and edits project code
Runs your package manager's audit command

From reading its instructions, not from running it.

Why it scores 77

Strongest on upkeep (100 of 100), weakest on trust (62).

Adoption35 points 63
Upkeep20 points 100
Trust20 points 62
Quality15 points 100
Reader answers10 points Not enough answers yet, so this does not count

How the formula works

Is security-and-hardening safe to install?

At least one scanner raised a medium warning. Read the results below. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.

Scanner	Result	Date
Gen Agent Trust Hub	Passed	Oct 31, 2026
Socket	Passed	Oct 31, 2026
Snyk	Low risk	Oct 31, 2026
Runlayer	Medium risk	Feb 22, 2026
ZeroLeaks	Passed	Apr 16, 2026

Details

Installs: 82,658
Repository stars: 115,385
Last repository change: Nov 1, 2026
Tokens always loaded: about 155
Tokens when used: about 4,224
License: MIT
Data confidence: High

Side-by-side comparisons

security-audit vs security-and-hardening

Alternatives to security-and-hardening

All skills for this job

security-review

For web developers adding login, payments, uploads or new API routes who want a security checklist at hand.

Score 70 20.2K installs

Get security-review
security-review

For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws.

Score 74 23.2K installs Official High-risk warning

Get security-review
penetration-testing-with-strix

For developers who want automated pentests that prove each finding with a working exploit.

Score 73 20.5K installs Official High-risk warning

Get penetration-testing-with-strix
better-auth-security-best-practices

For developers running Better Auth who want to lock down sessions, cookies and sign-in limits before launch.

Score 76 51K installs Official

Get better-auth-security-best-practices