Menu
Apply security controls, threat modeling, and hardening to code and infrastructure
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Build UIs that work for all users including keyboard navigation, screen readers, and WCAG 2.2
Design multi-agent systems with robust tool interfaces, state management, and failure handling
Build ML systems with disciplined training, evaluation, deployment, and safety practices
Design APIs that are stable, ergonomic, and evolvable
Design systems at the right scale with explicit trade-off documentation
Design services that are reliable, observable, secure, and maintainable
Baseado na classificação ocupacional SOC
| name | security-and-hardening |
| description | Apply security controls, threat modeling, and hardening to code and infrastructure |
| difficulty | senior |
| domains | ["general"] |
Security is not a feature you add — it is a property you maintain. Most security failures are not sophisticated attacks; they are missing input validation, exposed secrets, misconfigured permissions, and unpatched dependencies. This skill systematically eliminates these before they reach production.
/review workflowAsk: what can an attacker do with this change? What data does it touch? What systems does it connect to? Who has access? Threat model in 10 minutes with STRIDE:
git log --all -p | grep -i "password\|secret\|token\|key" — if anything shows, rotate immediatelynpm audit, pip-audit, or equivalent"This is an internal API — we don't need auth" Internal APIs are reached by internal attackers and misconfigured external clients. Every API needs auth.
"We'll add security hardening after launch" Security retrofitted onto an insecure design is more expensive and less effective than security built in from the start.
"The secret is only in the git history, not the current code" Git history is accessible to everyone who can clone the repo. Rotate the secret now.