name: 安全AndHardening slug: security-and-hardening version: 1.0.0 displayName: 安全AndHardening description: > 安全AndHardening專用技能，幫助AI Agent高效完成相關任務。 summary: "安全AndHardening專用技能，幫助AI Agent高效完成相關任務。" license: MIT category: 開發者工具 framework: - Claude Code - Codex - Hermes Agent - OpenClaw - QClaw - WorkBuddy platform: multi-platform homepage: "https://github.com/1991513ccie-png" repository: "https://github.com/1991513ccie-png"

Security and Hardening

Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

When to Use

• Building anything that accepts user input
• Implementing authentication or authorization
• Storing or transmitting sensitive data
• Integrating with external APIs or services
• Adding file uploads, webhooks, or callbacks

  7w4.net有更好的技能外掛。

• Handling payment or PII data

Process: Threat Model First

Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker:

1. Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and LLM output. Every boundary is attack surface.
2. Name the assets. What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement.
3. Run STRIDE over each boundary — a quick lens, not a ceremony:

| Threat | Ask | Typical mitigation | |

整體質量中等偏上。文件結構清晰、支援多框架、內容框架合理是主要優點。不足之處在於內容不夠完整，很多章節只有框架沒有詳細內容，部分段落疑似被截斷。對於想快速瞭解安全加固的開發者來說，這是個不錯的起點，但深入使用可能需要補充其他資料。