Warden Harden

What it does

When your agent uses it

• Asked to harden this
• Add security to this service
• What security do I need
• Secure this before launch

Example prompts

• “harden this”
• “add security to this service”
• “what security do I need”
• “/warden-harden”

Requirements

• Python 3
• Node.js
• Pre-approved tools (allowed-tools): Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Task, TodoWrite, AskUserQuestion

Workflow steps

10 steps, taken from the step headings in SKILL.md.

1. 1Read the Stack
2. 2Triage by Actual Risk
3. 3Implement Auth Controls
4. 4Input Validation
5. 5Rate Limiting
6. 6Security Headers
7. 7CORS
8. 8Secrets Management
9. 9Dependency Audit
10. 10Output the Hardening Spec

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Bash
  • Glob
  • Grep
  • WebFetch
  • WebSearch
  • Task
  • TodoWrite

  …and 1 more on the same allowed-tools line.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • npm
  • npx
  • trivy
  • gcloud

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use npm, npx and gcloud, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Warden Harden loads about 2.4k tokens when it runs. Until then it costs about 72 tokens; SKILL.md has 728 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~72

When it runs · the whole SKILL.md, loaded when a task matches

~2.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:176

  For any secrets found in source code, `.env` files, or CI configs:

• NoteMentions a .env fileSKILL.md:185

  3. Ensure `.env` is in `.gitignore` and `.env.example` (no real values) is committed instead

• NoteMentions a .env fileSKILL.md:189

  a managed service isn't available yet: `.env` file, never committed, loaded at runtime, documented in `.env.example`.

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Task, TodoWrite, AskUserQuestion

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 728 words, ~2,350 tokens.

name

warden-harden

description

Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to "harden this", "add security to this service", "what security do I need", or "secure this before launch".

allowed-tools

Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Task, TodoWrite, AskUserQuestion

version

0.6.4

author

tonone-ai <hello@tonone.ai>

license

MIT

# Framework detection
cat package.json 2>/dev/null | grep -E '"express|fastify|next|koa|hono"'
cat requirements.txt pyproject.toml 2>/dev/null | grep -E "fastapi|flask|django"
cat go.mod 2>/dev/null | grep -E "gin|echo|fiber|chi"

# Existing security middleware
grep -rl "helmet\|cors\|rate.limit\|ratelimit\|csrf\|csurf" --include="*.ts" --include="*.js" --include="*.py" . 2>/dev/null | head -10

# Auth setup
grep -rl "jwt\|session\|passport\|auth\|middleware" --include="*.ts" --include="*.js" --include="*.py" . 2>/dev/null | head -10

# Secrets pattern
grep -rl "process\.env\|os\.environ\|dotenv\|SecretManager\|Vault" --include="*.ts" --include="*.js" --include="*.py" . 2>/dev/null | head -10

# Dependency lock files
ls package-lock.json yarn.lock pnpm-lock.yaml poetry.lock Pipfile.lock go.sum 2>/dev/null

Cookie flags: HttpOnly; Secure; SameSite=Lax (Strict if no cross-site flows)
Session ID: regenerate on login and privilege escalation
Expiry: idle timeout (15–60 min) + absolute max (8–24h)
Logout: invalidate server-side session, clear cookie

Algorithm: RS256 or ES256 — never HS256 with a weak secret, never alg:none
Expiry: access token 15 min, refresh token 7–30 days with rotation
Storage: HttpOnly cookie (not localStorage) for web clients
Revocation: maintain a deny-list for refresh tokens; rotate on suspicious use
Validate: issuer, audience, expiry — all three, every time

Check ownership/permission on every resource read/write — not just "is user logged in"
RBAC: roles checked server-side, never trust client-supplied role claims
Row-level: filter by user_id/org_id in every query that returns user data

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
Content-Security-Policy: [tailored to app — see below]

Content-Security-Policy: default-src 'none'

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' [your-api-domains]; frame-ancestors 'none'

Access-Control-Allow-Origin: https://yourdomain.com  (exact origin, not *)
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true  (only if sending cookies/auth headers cross-origin)
Access-Control-Max-Age: 86400

# Node.js
npm audit --audit-level=high
npx better-npm-audit audit

# Python
pip-audit  # or: safety check

# Go
govulncheck ./...

# Container images
trivy image [image-name]

## Hardening Applied: [Service Name]

### Ship Blockers Fixed
- [change] — [file(s)]

### Hardening Implemented
- [change] — [file(s)]

### Remaining / Scheduled
- [item] — [why deferred] — [owner/sprint]

### Security Posture
| Control              | Before    | After     |
|----------------------|-----------|-----------|
| Auth middleware      | [status]  | [status]  |
| Authorization checks | [status]  | [status]  |
| Input validation     | [status]  | [status]  |
| Rate limiting        | [status]  | [status]  |
| Security headers     | [status]  | [status]  |
| CORS                 | [status]  | [status]  |
| Secrets management   | [status]  | [status]  |
| Dependencies         | [status]  | [status]  |

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in plugins/ai-agency/tonone/skills/warden-harden of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• .claude-plugin/plugin.json

Open the folder on GitHubat commit cfae287