New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Binary Hardening

by mohitmishra786 in mohitmishra786/low-level-dev-skills

Binary hardening skill for security-hardened C/C++ builds. An agent skill from mohitmishra786/low-level-dev-skills.

MITAuto-check passedDevOps & Cloud

Install Binary Hardening

skills CLI
$ npx skills add mohitmishra786/low-level-dev-skills --skill binary-hardening -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mohitmishra786/low-level-dev-skills binary-hardening --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mohitmishra786/low-level-dev-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/runtimes/binary-hardening .claude/skills/binary-hardening && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
binary-hardening
GitHub stars
253
Token cost
~2k tokens
SKILL.md length
382 words
Files
2 (incl. references)
Skills in repo
138
Repo updated
First seen
Licence
MIT

At a glance

Binary hardening skill for security-hardened C/C++ builds. An agent skill from mohitmishra786/low-level-dev-skills.

  • Works in 10 steps: Analyze existing binary with checksec → Hardening compiler and linker flags → Control Flow Integrity (CFI) → …
  • Seccomp-bpf syscall filtering
  • SKILL.md covers Purpose, Triggers, Workflow and Related skills
  • Calls pip

What it does

Binary Hardening is an agent skill from mohitmishra786/low-level-dev-skills. Binary hardening skill for security-hardened C/C++ builds. Use when enabling RELRO, PIE, stack canaries, FORTIFYSOURCE, CFI sanitizers, shadow stack, or seccomp-bpf syscall filtering. Covers checksec analysis, compiler and linker flags for hardened builds, and NSA/CISA-recommended mitigations. Activates on queries about binary hardening, checksec, RELRO, PIE, stack canaries, FORTIFYSOURCE, CFI, shadow stack, or seccomp.

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/hardening-flags.md`).

It sits in DevOps & Cloud, covering Deployment. It works with C++. The repository describes itself as: A curated suite of AI agent skills for systems and low-level programming with C/C++, Rust, and Zig toolchains, covering compilers, debuggers, profilers, build systems…. The licence is MIT.

When your agent uses it

  • Seccomp-bpf syscall filtering
  • Tasks that involve Deployment

Example prompts

  • “/binary-hardening”

Requirements

  • Python 3

Workflow steps

10 steps, taken from the step headings in SKILL.md.

  1. Analyze existing binary with checksec
  2. Hardening compiler and linker flags
  3. Control Flow Integrity (CFI)
  4. Stack canaries in depth
  5. FORTIFY_SOURCE
  6. seccomp-bpf syscall filtering
  7. Intel CET (Shadow Stack + IBT)
  8. ARM BTI and PAC (AArch64)
  9. ARM Memory Tagging (MTE)
  10. glibc shadow stack (2.39+)

What it can do on your machine

Read from SKILL.md and the folder at commit bdc5847. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • pip

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use pip, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Binary Hardening loads about 2k tokens when it runs, and up to ~2.7k if it reads all its reference files. Until then it costs about 111 tokens; SKILL.md has 382 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~111
When it runs · the whole SKILL.md, loaded when a task matches
~2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from mohitmishra786/low-level-dev-skills at commit bdc5847, republished under its MIT licence (© mohitmishra786). 382 words, ~1,993 tokens.

Download SKILL.mdSave it as .claude/skills/binary-hardening/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
binary-hardening
description
Binary hardening skill for security-hardened C/C++ builds. Use when enabling RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI sanitizers, shadow stack, or seccomp-bpf syscall filtering. Covers checksec analysis, compiler and linker flags for hardened builds, and NSA/CISA-recommended mitigations. Activates on queries about binary hardening, checksec, RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI, shadow stack, or seccomp.

Binary Hardening

Purpose

Guide agents through enabling and verifying binary security mitigations: checksec analysis, compiler and linker hardening flags (RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI), hardware shadow stack, and seccomp-bpf syscall filtering for defense-in-depth.

Triggers

  • "How do I harden my binary against exploits?"
  • "How do I check what security mitigations my binary has?"
  • "What does checksec output mean?"
  • "How do I enable RELRO, PIE, and stack canaries?"
  • "How do I use seccomp to restrict syscalls?"
  • "How do I enable CFI (control flow integrity)?"

Workflow

1. Analyze existing binary with checksec
bash
# Install checksec
pip install checksec.py   # or: apt install checksec

# Check a binary
checksec --file=./mybinary
checksec --file=/usr/bin/ssh

# Output example
# RELRO          STACK CANARY   NX    PIE    RPATH  RUNPATH  Symbols  FORTIFY  Fortified  Fortifiable  FILE
# Full RELRO     Canary found   NX    PIE    No RPATH  No RUNPATH  No Symbols  Yes   6   10   ./mybinary

# Check all binaries in a directory
checksec --dir=/usr/bin
ProtectionGood valueConcern
RELROFull RELROPartial / No RELRO
Stack CanaryCanary foundNo canary
NXNX enabledNX disabled
PIEPIE enabledNo PIE
FORTIFYYesNo
2. Hardening compiler and linker flags
bash
# Full hardened build (GCC or Clang)
CFLAGS="-O2 -pipe \
  -fstack-protector-strong \
  -fstack-clash-protection \
  -fcf-protection \
  -D_FORTIFY_SOURCE=3 \
  -D_GLIBCXX_ASSERTIONS \
  -fPIE \
  -Wformat -Wformat-security -Werror=format-security"

LDFLAGS="-pie \
  -Wl,-z,relro \
  -Wl,-z,now \
  -Wl,-z,noexecstack \
  -Wl,-z,separate-code"

gcc ${CFLAGS} -o prog main.c ${LDFLAGS}

Flag reference:

FlagProtectionNotes
-fstack-protector-strongStack canaryStronger than -fstack-protector
-fstack-clash-protectionStack clashPrevents huge stack allocations
-fcf-protectionIntel CET (IBT+SHSTK)x86 hardware CFI (kernel+CPU required)
-D_FORTIFY_SOURCE=2Buffer overflow checksAdds bounds checks to string/mem functions
-D_FORTIFY_SOURCE=3Enhanced FORTIFYGCC ≥12, Clang ≥12
-fPIE + -piePIE/ASLRPosition independent executable
-Wl,-z,relroPartial RELROMakes GOT read-only before main
-Wl,-z,nowFull RELROResolves all PLT at startup → GOT fully RO
-Wl,-z,noexecstackNX stackMarks stack non-executable
3. Control Flow Integrity (CFI)

Clang's CFI prevents calling virtual functions through wrong types (vtable CFI) and indirect calls to mismatched functions:

bash
# Clang CFI — requires LTO and visibility
clang -fsanitize=cfi -fvisibility=hidden -flto \
      -O2 -fPIE -pie main.cpp -o prog

# Specific CFI checks
clang -fsanitize=cfi-vcall          # virtual call type check
clang -fsanitize=cfi-icall          # indirect call type check
clang -fsanitize=cfi-derived-cast   # derived-to-base cast
clang -fsanitize=cfi-unrelated-cast # unrelated type cast

# Cross-DSO CFI (across shared libraries — more complex)
clang -fsanitize=cfi -fsanitize-cfi-cross-dso -flto -fPIC -shared
bash
# Microsoft CFG (Windows equivalent)
cl /guard:cf prog.c
link /guard:cf prog.obj
4. Stack canaries in depth
bash
# GCC canary options
-fno-stack-protector       # disabled
-fstack-protector          # protect functions with alloca or buffers > 8 bytes
-fstack-protector-strong   # protect functions with local arrays/addresses taken
-fstack-protector-all      # protect all functions (slowest, most complete)

# Verify canary presence
objdump -d prog | grep -A5 "__stack_chk"
readelf -s prog | grep "stack_chk"
Show full SKILL.md (155 more words)Show less
5. FORTIFY_SOURCE

FORTIFY_SOURCE wraps unsafe libc functions (memcpy, strcpy, sprintf) with bounds-checked versions when the buffer size can be determined at compile time:

bash
# Level 2 (GCC/Clang default for hardened builds)
-D_FORTIFY_SOURCE=2
# Runtime check: abort() on overflow

# Level 3 (GCC ≥12, catches more cases)
-D_FORTIFY_SOURCE=3
# Adds dynamic buffer size tracking for more coverage

# Check FORTIFY coverage
objdump -d prog | grep "__.*_chk"     # fortified variants
checksec --file=prog | grep FORTIFY
6. seccomp-bpf syscall filtering
c
#include <seccomp.h>

void apply_seccomp_filter(void) {
    scmp_filter_ctx ctx;

    // Default: kill process on any non-allowlisted syscall
    ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);

    // Allowlist needed syscalls
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);

    // Apply filter (irreversible after this point)
    seccomp_load(ctx);
    seccomp_release(ctx);
}

// Call early in main(), after all setup
int main(void) {
    // ... initialization ...
    apply_seccomp_filter();
    // ... restricted operation ...
}
bash
# Test seccomp filter with strace
strace -e trace=all ./prog 2>&1 | grep "killed by SIGSYS"

# Profile syscalls to build allowlist
strace -c ./prog    # count all syscalls used
7. Intel CET (Shadow Stack + IBT)
bash
# Full CET: SHSTK (shadow stack) + IBT (indirect branch tracking)
gcc -fcf-protection=full -O2 -o prog main.c

# Verify in binary
readelf -n prog | grep -E 'SHSTK|IBT'
readelf --notes prog | grep GNU_PROPERTY

# IBT landing pads in disassembly
objdump -d prog | grep endbr64

# CPU and kernel support
grep -m1 shstk /proc/cpuinfo

Requires hardware CET support (Intel Tiger Lake+ for SHSTK/IBT; AMD Zen 3+ for shadow stack on supported SKUs) and a kernel built with CET enabled.

8. ARM BTI and PAC (AArch64)
bash
# Branch Target Identification + Pointer Authentication
gcc -mbranch-protection=standard -O2 -o prog main.c
# Or: -mbranch-protection=bti+pauth

readelf -n prog | grep -E 'BTI|PAC'
llvm-objdump -d prog | grep bti
FeatureProtects
BTIIndirect branch to non-marked targets
PACSigned return addresses and pointers (ARMv8.3+)
9. ARM Memory Tagging (MTE)
bash
# Userspace MTE tagging (experimental, arm64 hardware)
clang -fsanitize=memtag -g -o prog main.c

# Check MTE CPU support
grep -m1 mte /proc/cpuinfo

MTE assigns 4-bit tags to 16-byte granules — hardware detects tag mismatch on access.

10. glibc shadow stack (2.39+)
bash
# Recent glibc may enable shadow stack for CET when hardware supports SHSTK
ldd --version   # feature availability varies by distro glibc build

# Explicit link with shadow stack support (toolchain dependent)
gcc -fcf-protection=full -Wl,-z,shstk -o prog main.c

# Verify GNU_PROPERTY_SHSTK in output
readelf -n prog | grep SHSTK

Shadow stack maintains a hardware-protected copy of return addresses separate from the data stack.

For the full hardening flags reference, see references/hardening-flags.md.

  • Use skills/runtimes/sanitizers for ASan/UBSan during development
  • Use skills/observability/ebpf for seccomp-bpf program writing with libbpf
  • Use skills/rust/rust-security for Rust's memory-safety hardening approach
  • Use skills/binaries/elf-inspection to verify mitigations in ELF binaries

© mohitmishra786, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/runtimes/binary-hardening of mohitmishra786/low-level-dev-skills.

  • SKILL.md
  • references/hardening-flags.md

Open the folder on GitHubat commit bdc5847

Compare with similar skills

Binary Hardening next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Binary Hardening compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Binary Hardening this skillmohitmishra786/low-level-dev-skills253—~2kAutomated safety check: PassMIT
Release Processscragnog/HOT-Step-CPP173—~5.1kAutomated safety check: PassMIT
Genie API Service Docsqualcomm/qai-appbuilder247—~840Automated safety check: PassCustom licence
Kubeshark Installerkubeshark/kubeshark12k—~3.6kAutomated safety check: NotesApache-2.0
GreptimeDB Dev Docker ImageGreptimeTeam/greptimedb6.7k—~4kAutomated safety check: NotesApache-2.0
KubeSphere ServiceMesh Managerkubesphere/kubesphere17k—~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Release Process

    scragnog/HOT-Step-CPP

    Runbook for cutting and publishing a HOT-Step CPP release via a v git tag that triggers the multi-platform CI build and drafts a GitHub Release.

    173 GitHub stars~5.1k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • Genie API Service Docs

    qualcomm/qai-appbuilder

    GenieAPIService technical documentation retrieval. An agent skill from qualcomm/qai-appbuilder.

    247 GitHub stars~840 tokensUpdated today
    DevelopmentAuto-check passed

  • Kubeshark Installer

    kubeshark/kubeshark

    Installs and configures Kubeshark on a Kubernetes cluster, choosing between the quick CLI path and a Helm install with custom values.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • GreptimeDB Dev Docker Image

    GreptimeTeam/greptimedb

    Packages a locally built GreptimeDB debug binary into a development-only Docker image for local-cluster testing, with an optional push to a dev registry.

    6.7k GitHub stars~4k tokensUpdated today
    DevOps & CloudAuto-check: notes

  • KubeSphere ServiceMesh Manager

    kubesphere/kubesphere

    Installs, checks and troubleshoots the KubeSphere ServiceMesh extension (Istio, Kiali, Jaeger), including grayscale release, sidecar injection, topology and tracing issues.

    17k GitHub stars~2.4k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • Vercel

    remotion-dev/remotion

    Official

    Set up a Codex monitor for Vercel deployments and preview URLs.

    63k GitHub stars~1.2k tokensUpdated today
    DevOps & CloudAuto-check passed

More from mohitmishra786/low-level-dev-skills

All 138 skills in this repo

  • ARM and AArch64 Assembly

    mohitmishra786/low-level-dev-skills

    Guides reading and writing AArch64 and ARM Thumb assembly: compiler output, inline asm, registers, the AAPCS calling convention and NEON or SVE basics.

    253 GitHub stars~1.9k tokensUpdated 3 mo ago
    Auto-check passed

  • RISC-V Assembly Guide

    mohitmishra786/low-level-dev-skills

    Reference for RISC-V assembly on RV32 and RV64: register names and calling convention, extension naming, GCC and Clang inline asm, and QEMU with GDB debugging.

    253 GitHub stars~1.8k tokensUpdated 3 mo ago
    Auto-check passed

  • x86-64 Assembly Reference

    mohitmishra786/low-level-dev-skills

    Explains x86-64 registers, the System V AMD64 calling convention, and how to read compiler-generated or inline assembly.

    253 GitHub stars~1.5k tokensUpdated 3 mo ago
    Auto-check passed

  • Bazel for C and C++

    mohitmishra786/low-level-dev-skills

    Guides your agent through Bazel for C/C++ projects: BUILD files, Bzlmod dependencies, toolchain registration, remote execution, dependency queries and sandbox debugging.

    253 GitHub stars~1.5k tokensUpdated 3 mo ago
    Auto-check passed

  • Binutils

    mohitmishra786/low-level-dev-skills

    GNU binutils skill for binary manipulation and analysis. An agent skill from mohitmishra786/low-level-dev-skills.

    253 GitHub stars~1.2k tokensUpdated 3 mo ago
    Auto-check passed

  • Build Acceleration

    mohitmishra786/low-level-dev-skills

    Build acceleration skill for C/C++ projects. An agent skill from mohitmishra786/low-level-dev-skills.

    253 GitHub stars~1.4k tokensUpdated 3 mo ago
    Auto-check passed

Works with

Categories

Questions about Binary Hardening

What does Binary Hardening do?

Binary hardening skill for security-hardened C/C++ builds. An agent skill from mohitmishra786/low-level-dev-skills. Binary Hardening is an agent skill from mohitmishra786/low-level-dev-skills. Binary hardening skill for security-hardened C/C++ builds.

When should I use Binary Hardening?

Binary Hardening fits situations like: seccomp-bpf syscall filtering; tasks that involve Deployment.

How do I install Binary Hardening in Claude Code?

Run `npx skills add mohitmishra786/low-level-dev-skills --skill binary-hardening -a claude-code`. Or copy the skill folder (skills/runtimes/binary-hardening in mohitmishra786/low-level-dev-skills) into .claude/skills/binary-hardening in your project. Claude Code loads it when a task matches its description.

How do I install Binary Hardening in Codex?

Run `npx skills add mohitmishra786/low-level-dev-skills --skill binary-hardening -a codex`. Or copy the skill folder (skills/runtimes/binary-hardening in mohitmishra786/low-level-dev-skills) into .agents/skills/binary-hardening in your project. Codex loads it when a task matches its description.

Can I use Binary Hardening in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mohitmishra786/low-level-dev-skills --skill binary-hardening -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/binary-hardening, .gemini/skills/binary-hardening, .github/skills/binary-hardening and .opencode/skills/binary-hardening in your project.

What does Binary Hardening need to run?

Going by SKILL.md and its folder, Binary Hardening needs the command-line tools its instructions call (pip). Our summary lists: Python 3.

Does Binary Hardening access the network?

SKILL.md contains no URLs. Its commands use pip, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Binary Hardening safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Binary Hardening use?

Binary Hardening is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Binary Hardening use?

About 2k tokens (SKILL.md is roughly 8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 750 tokens, read only when the agent opens those files.

What are the alternatives to Binary Hardening?

Skills that share tags, products or a category with Binary Hardening: Release Process (scragnog/HOT-Step-CPP, 173 stars), Genie API Service Docs (qualcomm/qai-appbuilder, 247 stars), Kubeshark Installer (kubeshark/kubeshark, 12k stars) and GreptimeDB Dev Docker Image (GreptimeTeam/greptimedb, 6.7k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Binary Hardening?

mohitmishra786 (a GitHub user) maintains it in mohitmishra786/low-level-dev-skills, which has 253 GitHub stars. The repository holds 138 skills in this directory. The repository was last updated on June 27, 2026.

Source: mohitmishra786/low-level-dev-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.