Security and Hardening

npx skills add addyosmani/agent-skills --skill security-and-hardening

It starts by mapping where untrusted data enters the system — requests, form fields, uploads, webhooks, third-party APIs and LLM output — naming the assets worth stealing, then running STRIDE across each boundary. Controls are written only after that, which keeps each one tied to a named threat instead of a generic checklist. Coverage spans OWASP Top 10 territory, authentication and session handling, secrets management, and privacy obligations under GDPR and CCPA.