security-hardening
Hardens NitroCine security by auditing configurations, secrets, and auth flows. Focuses on preventing leaks and abuse.
Install
mkdir -p .claude/skills/security-hardening-hoangduc1003 && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/11124" && unzip -o skill.zip -d .claude/skills/security-hardening-hoangduc1003 && rm skill.zipInstalls to .claude/skills/security-hardening-hoangduc1003
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Audit and harden NitroCine secrets, environment configuration, authentication, authorization, input validation, booking prices, Stripe webhooks, error responses, and abuse controls. Use for security reviews or changes touching payments, booking, admin APIs, or external credentials.Key capabilities
- →Scan files for exposed credential patterns
- →Enforce server-side validation for booking and payments
- →Verify Stripe webhook signatures
- →Review CORS allowlists and redirect URLs
- →Implement rate limiting for abuse-sensitive endpoints
How it works
The agent audits code for security vulnerabilities by checking for exposed secrets, validating server-side logic, and enforcing secure configuration practices.
Inputs & outputs
When to use security-hardening
- →Audit NitroCine secrets
- →Validate API authentication
- →Secure Stripe webhook handling
- →Review CORS allowlists
About this skill
Harden Security
- Search tracked files for credential patterns; report exposure without echoing values.
- Keep secrets server-side and document placeholders only in
.env.example. - Validate and normalize every untrusted route parameter and body field.
- Derive booking prices and user identity server-side; never trust client totals or user IDs.
- Verify Stripe signatures against the raw body and make callbacks idempotent.
- Enforce ownership on pay, cancel, and read operations; enforce admin authorization on mutations.
- Avoid returning stack traces, provider errors, connection strings, or internal identifiers unnecessarily.
- Review CORS and origin-derived redirect URLs against an allowlist for production.
- Add rate limiting or note it as follow-up when endpoints are abuse-sensitive.
- Verify failure behavior for missing or unavailable Redis because security invariants must not depend solely on it.
Prioritize exploitable findings and keep remediation scoped. Re-run secret scanning and regression tests before handoff.
When not to use it
- →Non-NitroCine application security reviews
- →Client-side only validation tasks
Limitations
- →Remediation must remain scoped to the findings
- →Security invariants must not depend solely on Redis
How it compares
This process systematically enforces security invariants across sensitive operations rather than relying on ad-hoc security checks.
Compared to similar skills
security-hardening side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-hardening (this skill) | 0 | 1mo | Review | Advanced |
| 1password | 27 | 2mo | Review | Intermediate |
| security-compliance | 19 | 7mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 7mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.