القائمة
Apply security controls, threat modeling, and hardening to code and infrastructure
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Build UIs that work for all users including keyboard navigation, screen readers, and WCAG 2.2
Design multi-agent systems with robust tool interfaces, state management, and failure handling
Build ML systems with disciplined training, evaluation, deployment, and safety practices
Design APIs that are stable, ergonomic, and evolvable
Design systems at the right scale with explicit trade-off documentation
Design services that are reliable, observable, secure, and maintainable
| name | security-and-hardening |
| description | Apply security controls, threat modeling, and hardening to code and infrastructure |
| difficulty | senior |
| domains | ["general"] |
Security is not a feature you add — it is a property you maintain. Most security failures are not sophisticated attacks; they are missing input validation, exposed secrets, misconfigured permissions, and unpatched dependencies. This skill systematically eliminates these before they reach production.
/review workflowAsk: what can an attacker do with this change? What data does it touch? What systems does it connect to? Who has access? Threat model in 10 minutes with STRIDE:
git log --all -p | grep -i "password\|secret\|token\|key" — if anything shows, rotate immediatelynpm audit, pip-audit, or equivalent"This is an internal API — we don't need auth" Internal APIs are reached by internal attackers and misconfigured external clients. Every API needs auth.
"We'll add security hardening after launch" Security retrofitted onto an insecure design is more expensive and less effective than security built in from the start.
"The secret is only in the git history, not the current code" Git history is accessible to everyone who can clone the repo. Rotate the secret now.