Security Hardening

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass, no license.

Audit 0.4.1 · source sha dd4da722e22a · 18 Oct 2026Report an issue or request a re-scan

• Publisheragulli GitHub userOwner of the repository this skill is read from
• Source folderagulli/atlas-agents/ch09_agent_skills/skills/security-hardeningThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdictdd4da722e22aA new audit runs when the source changes
• Repository statusNot archivedLast push 93 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Harden an application or service against common attack vectors. Use when asked to improve security posture, secure an API, harden a server, or prepare for a security review.

---
name: security-hardening
description: Harden an application or service against common attack vectors. Use when asked to improve security posture, secure an API, harden a server, or prepare for a security review.
license: MIT
---

## Overview

Security hardening is not about chasing perfect — it's about raising the cost of attack above the attacker's budget. Work systematically through the layers.

## Process

### Layer 1: Authentication and Authorization

1. Verify all endpoints require authentication. Check for unprotected routes using:
   ```bash
   grep -rn "route\|@app\.\|router\." src/ | grep -v "login\|health\|docs"
   ```
2. Check that authorization is enforced at the data layer, not just the route layer. A user who can reach `/orders` should only see *their* orders.
3. Confirm tokens expire. JWTs must have `exp` claims. Sessions must have server-side expiry.

### Layer 2: Input Validation

4. Every user-supplied value that touches a database must use parameterized queries. Grep for f-string SQL:
   ```bash
   grep -rn "f\"SELECT\|f'SELECT\|format.*SELECT" src/
   ```
5. Every file path from user input must be validated against an allowlist or a sandboxed directory. Check for `os.path.join(base, user_input)` without `os.path.abspath` + `startswith` guard.

### Layer 3: Secrets and Configuration

6. Scan for hardcoded secrets:
   ```bash
   grep -rn "password\s*=\s*[\"'][^\"']\|api_key\s*=\s*[\"'][^\"']" src/
   ```
7. Confirm all secrets come from environment variables or a secrets manager, not from config files committed to version control.
8. Check `.gitignore` includes `.env`, `*.key`, `*.pem`.

### Layer 4: Dependencies and Infrastructure

9. Run the `dependency-audit` skill to check for vulnerable packages.
10. Check HTTP security headers are set (for web services):
    - `Content-Security-Policy`
    - `X-Frame-Options: DENY`
    - `Strict-Transport-Security`
    - `X-Content-Type-Options: nosniff`

### Layer 5: Output

11. Write findings as a prioritized list: Critical → High → Medium → Low. For each finding: what it is, where it is (file:line), how to fix it.

## Rationalizations

| Excuse | Rebuttal |
|--------|----------|
| "This is an internal service, it doesn't need hardening" | Internal services are the primary target of lateral movement attacks after initial breach. |
| "We'll harden it before the public launch" | Security debt compounds. Fix it before it goes anywhere. |
| "The framework handles security" | Frameworks handle some things. You must handle the application-level concerns. |

## Verification

- [ ] All four layers were checked (not just the ones that seemed relevant)
- [ ] No hardcoded secrets found in source or git history
- [ ] Every critical and high finding has a specific remediation
- [ ] A finding was produced for each layer — even if it's "no issues found"

Excerpt, first 2,852 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/agulli/atlas-agents
git -C atlas-agents checkout dd4da722e22a

Works in

1. 2026-10-18
   ✓SAFE B 89 / 100

   first audit · source dd4da722e22a

Questions about Security Hardening

• github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skill — the audited source at commit dd4da722e22a and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology