agentsclimarketplace
Sign in

Vulnerability hardening

Skill K95M65/AI_ONBOARD/skills/vulnerability-hardening

Harden an application or service against attack — defense-in-depth at the config, deploy, and runtime layer (security headers, TLS, least-privilege, safe defaults, attack-surface reduction). Use when hardening a deployment, reviewing infra/config security, or turning audit findings into systemic defenses.From its SKILL.md

Install
npx -y skills add K95M65/AI_ONBOARD --skill vulnerability-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 24 days oldThe repository was created 24 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.9 KB, 375 tokens by cl100k_base, as published. Nobody here has run it

Vulnerability hardening

Where secure-coding is about the code, hardening is about the surface around it — config, deploy, and runtime defenses so a single bug doesn't become a breach.

When to use

Hardening a service before/after deploy, reviewing infrastructure and config, or converting audit findings into durable, systemic controls.

The layers

  1. Attack surface. Close what you don't need: disable unused endpoints/ports/features, remove default accounts, don't expose admin/debug in prod, minimize the deploy image.
  2. Transport & headers. TLS only (HSTS); set the security headers — run bash scripts/check-headers.sh <url> and close the gaps (see reference.md).
  3. Least privilege. Narrow IAM/roles, scoped tokens, read-only where possible, per-service credentials. No wildcard cloud permissions.
  4. Safe defaults. Deny-by-default network/CORS, secure cookie flags, sane timeouts and body-size limits.
  5. Abuse resistance. Rate limits and quotas on public/expensive endpoints; bounded resource use.
  6. Dependency & supply chain. Pin versions + lockfile, scan (dependency-vuln-scan), verify integrity.
  7. Observability. Log security events; alert on authz failures and anomalies (you can't defend what you can't see).

On Cloudflare

Much of this is platform config: WAF rules, rate limiting, Turnstile for bots, Access for auth-gating, secure headers via Workers/Transform Rules. Prefer the platform control over hand-rolling.

Verify

Re-run security-audit; confirm each prior finding has a systemic control, not just a point fix.

What ships with it: 2 files

3.4 KB alongside SKILL.md, 1 of them executable

scripts/

Keep looking

Skills are one crate of 326,834. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.