Security And Hardening
penpot/penpot
Hardens code against vulnerabilities. An agent skill from penpot/penpot.
Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.
Install Hardening Siti
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-siti --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .claude/skills/hardening-siti && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .claude/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-sitiType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-siti --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .agents/skills/hardening-siti && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .agents/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-siti --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .cursor/skills/hardening-siti && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .cursor/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ccplugins/awesome-claude-code-plugins.git --path plugins/web-security-guard/skills/hardening-siti--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-siti --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .gemini/skills/hardening-siti && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .gemini/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-sitiInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .github/skills/hardening-siti && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .github/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ccplugins/awesome-claude-code-plugins hardening-siti --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccplugins/awesome-claude-code-plugins.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/web-security-guard/skills/hardening-siti .opencode/skills/hardening-siti && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hardening-siti" agent skill from https://github.com/ccplugins/awesome-claude-code-plugins/tree/main/plugins/web-security-guard/skills/hardening-siti into .opencode/skills/hardening-siti/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hardening-siti", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
hardening-siti- GitHub stars
- 970
- Token cost
- ~875 tokens
- SKILL.md length
- 366 words
- Files
- 1
- Skills in repo
- 68
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.
- Works in 8 steps: Security headers → Input e output → Cookie e sessioni → …
- Costruisci unapp
- SKILL.md covers Regole obbligatorie and Checklist finale
- Calls npm
What it does
Hardening Siti is an agent skill from ccplugins/awesome-claude-code-plugins. Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app. Copre security headers, CSP, HTTPS, validazione input, cookie, CORS, upload, gestione errori e OWASP Top 10. Trigger - "crea un sito", "costruisci un'app", "metti in sicurezza", "proteggi il sito", "hardening", "security headers", "build a website".
Its SKILL.md is about 880 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Secure coding and Web application vulnerabilities. The repository describes itself as: Awesome Claude Code plugins — a curated list of slash commands, subagents, MCP servers, and hooks for Claude Code. The licence is Apache-2.0.
When your agent uses it
- Costruisci unapp
- Metti in sicurezza
- Proteggi il sito
- Security headers
Example prompts
- “crea un sito”
- “costruisci un”
- “metti in sicurezza”
- “/hardening-siti”
Workflow steps
8 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 5bd4f16. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npm
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Hardening Siti loads about 875 tokens when it runs. Until then it costs about 94 tokens; SKILL.md has 366 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:49
repo: usare variabili d'ambiente e file `.env` in `.gitignore`. - NoteMentions a .env fileSKILL.md:50
- Generare sempre `.gitignore` con `.env`, `node_modules`, credenziali.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from ccplugins/awesome-claude-code-plugins at commit 5bd4f16, republished under its Apache-2.0 licence (© ccplugins). 366 words, ~875 tokens.
Download SKILL.mdSave it as
.claude/skills/hardening-siti/SKILL.md (or your agent's skills folder).- name
- hardening-siti
- description
- Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app. Copre security headers, CSP, HTTPS, validazione input, cookie, CORS, upload, gestione errori e OWASP Top 10. Trigger - "crea un sito", "costruisci un'app", "metti in sicurezza", "proteggi il sito", "hardening", "security headers", "build a website".
Hardening Siti
Quando si costruisce o si modifica un sito/app, applicare SEMPRE queste regole di sicurezza senza che l'utente debba chiederlo. Segnalare nel riepilogo finale quali protezioni sono state applicate.
Regole obbligatorie
1. Security headers
Applicare su ogni risposta HTML:
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'In Node/Express usare helmet(). In Django attivare SECURE_* settings. Su hosting statico (Netlify/Vercel/GitHub Pages) usare il file headers della piattaforma. Adattare la CSP alle risorse reali del sito (CDN, font, analytics) — mai usare unsafe-inline per gli script; preferire nonce o hash.
2. Input e output
- Validare OGNI input lato server (tipo, lunghezza, formato, whitelist). La validazione client è solo UX.
- Query al database SOLO parametrizzate o via ORM. Mai concatenare stringhe in SQL.
- Escapare l'output nei template (autoescaping attivo). Mai inserire input utente in
innerHTML,eval, attributi evento o URL senza sanitizzazione. - Path file: mai costruire percorsi da input utente; usare ID mappati o
path.basename+ directory fissa.
3. Cookie e sessioni
- Cookie di sessione:
HttpOnly; Secure; SameSite=Lax(oStrictper azioni sensibili). - Rigenerare l'ID sessione al login. Scadenza assoluta e per inattività.
- Protezione CSRF su ogni form/azione che modifica stato (token CSRF o SameSite + verifica Origin).
4. CORS
- Mai
Access-Control-Allow-Origin: *su endpoint autenticati. Whitelist esplicita di origin.
5. Upload di file
- Whitelist di estensioni E content-type verificato sul contenuto reale (magic bytes).
- Rinominare i file con ID casuali, salvarli FUORI dalla web root o su storage separato, limitare la dimensione.
Show full SKILL.md (136 more words)Show less
6. Errori e log
- Mai mostrare stack trace o dettagli interni all'utente; pagina di errore generica + log lato server.
- Loggare login, errori di autenticazione, pagamenti e azioni amministrative (senza dati sensibili nei log).
7. Segreti e dipendenze
- Mai chiavi/API key/password nel codice o nella repo: usare variabili d'ambiente e file
.envin.gitignore. - Generare sempre
.gitignorecon.env,node_modules, credenziali. - Usare versioni aggiornate delle dipendenze; consigliare
npm audit/pip-audit(vedi skill sicurezza-github per l'automazione).
8. HTTPS
- Tutto il traffico in HTTPS, redirect da HTTP, HSTS attivo. In sviluppo locale va bene HTTP ma documentare la differenza.
Checklist finale
Prima di consegnare un sito/app, verificare: headers presenti, query parametrizzate, validazione server, cookie sicuri, CSRF, niente segreti nel codice, errori generici, .gitignore corretto. Elencare all'utente le protezioni applicate e gli eventuali punti che richiedono configurazione sul suo hosting.
© ccplugins, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in plugins/web-security-guard/skills/hardening-siti of ccplugins/awesome-claude-code-plugins.
Open the folder on GitHubat commit 5bd4f16
Compare with similar skills
Hardening Siti next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hardening Siti this skillccplugins/awesome-claude-code-plugins | 970 | — | ~875 | Automated safety check: Notes | Apache-2.0 | |
| Security And Hardeningpenpot/penpot | 61k | 6 repos | ~4.7k | Automated safety check: Notes | MPL-2.0 | |
| Fix Strix Security Findingsusestrix/strix | 67k | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| Security Audit Scannerruvnet/ruflo | 74k | 2 repos | ~823 | Automated safety check: Pass | MIT | |
| Security Verification Gatefengshao1227/ccg-workflow | 5.9k | — | ~621 | Automated safety check: Notes | MIT | |
| Security and Hardeningaddyosmani/agent-skills | 103k | 1 repos | ~4.4k | Automated safety check: Notes | MIT |
Similar skills
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
Security Verification Gate
fengshao1227/ccg-workflow
Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.
Security and Hardening
addyosmani/agent-skills
Applies a threat-model-first approach to web code that handles untrusted input, authentication, data storage, dependencies or personal data.
- Official
Code Security
semgrep/skills
Security guidelines for writing secure code. An agent skill from semgrep/skills.
More from ccplugins/awesome-claude-code-plugins
All 68 skills in this repoAI Meeting
ccplugins/awesome-claude-code-plugins
Run structured AI meetings for plans, product ideas, technical designs, business decisions, feature proposals, and strategy choices.
Fastapi App
ccplugins/awesome-claude-code-plugins
Bootstrap a new FastAPI backend with async SQLAlchemy 2.0, asyncpg, Alembic, Pydantic v2, and no deprecated APIs.
Flutter App
ccplugins/awesome-claude-code-plugins
Bootstrap a new Flutter mobile app with clean architecture, Riverpod, FVM-pinned SDK, current packages, and no deprecated APIs.
Nextjs App
ccplugins/awesome-claude-code-plugins
Bootstrap a new Next.js (App Router, TypeScript) web app with current packages and no deprecated APIs.
Dev Report
ccplugins/awesome-claude-code-plugins
Write up a coding session for a non-technical stakeholder — the context, what was built, and the engineering reasoning behind it — the way a senior engineer briefs a product manager who does not…
Difesa Attacchi
ccplugins/awesome-claude-code-plugins
Aggiunge a un sito/app un agente di difesa che rileva e blocca richieste malevole (SQL injection, XSS, path traversal, brute force, bot) con rate limiting, blocklist IP e modalità lockdown che…
Related
Categories
Questions about Hardening Siti
What does Hardening Siti do?
Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app. Hardening Siti is an agent skill from ccplugins/awesome-claude-code-plugins. Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app.
When should I use Hardening Siti?
Hardening Siti fits situations like: costruisci unapp; metti in sicurezza; proteggi il sito; security headers.
How do I install Hardening Siti in Claude Code?
Run `npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a claude-code`. Or copy the skill folder (plugins/web-security-guard/skills/hardening-siti in ccplugins/awesome-claude-code-plugins) into .claude/skills/hardening-siti in your project. Claude Code loads it when a task matches its description.
How do I install Hardening Siti in Codex?
Run `npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a codex`. Or copy the skill folder (plugins/web-security-guard/skills/hardening-siti in ccplugins/awesome-claude-code-plugins) into .agents/skills/hardening-siti in your project. Codex loads it when a task matches its description.
Can I use Hardening Siti in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ccplugins/awesome-claude-code-plugins --skill hardening-siti -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hardening-siti, .gemini/skills/hardening-siti, .github/skills/hardening-siti and .opencode/skills/hardening-siti in your project.
What does Hardening Siti need to run?
Going by SKILL.md and its folder, Hardening Siti needs the command-line tools its instructions call (npm).
Does Hardening Siti access the network?
SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Hardening Siti safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Hardening Siti use?
Hardening Siti is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Hardening Siti use?
About 875 tokens (SKILL.md is roughly 3.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Hardening Siti?
Skills that share tags, products or a category with Hardening Siti: Security And Hardening (penpot/penpot, 61k stars), Fix Strix Security Findings (usestrix/strix, 67k stars), Security Audit Scanner (ruvnet/ruflo, 74k stars) and Security Verification Gate (fengshao1227/ccg-workflow, 5.9k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Hardening Siti?
ccplugins (a GitHub organization) maintains it in ccplugins/awesome-claude-code-plugins, which has 970 GitHub stars. The repository holds 68 skills in this directory. The repository was last updated on August 12, 2026.
Source: ccplugins/awesome-claude-code-plugins on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.