Scan the code, fix what it finds, then check what scanners miss before launch.
Each part works on its own. In this kit each one hands the next a file.
Use
Scans your source code for known security flaws and saves each one with its file and line.
Give your agent
Has your agent map where outside data gets in, fix each issue and audit your packages.
Run
Looks for what scanners miss, such as open tables and missing ownership checks, and ranks it.
Use any part on its own, or all three in this order.
In the order you use them.
In the project folder run snyk code test --json-file-output=snyk-code.json and give the file to your agent.
Or use ZeroPath or Claude Security; keep the skill and the prompt.
Paste threat-model.md into [What the app does, its users, data and stack]; a coding agent reads the repo for [Code to check].
---
name: security-and-hardening
description: Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
---
# Security and Hardening
## Overview
Security-first development practices for web applications. Treat every
external input as hostile, every secret as sacred, and every
authorization check as mandatory. Security isn't a phase — it's a
Fill in the 2 blanks, then run it.
Yes, to start. Snyk has a free plan, and the skill and the prompt are free.
Yes. ZeroPath and Claude Security do the same job well. Keep the skill and the prompt.
Run npx skills add addyosmani/agent-skills --skill security-and-hardening. Your agent reads the skill when the task fits.
On its page: fill in the blanks, then copy it or open it in ChatGPT, Claude or Grok.
We do. A sponsor can take the labelled row under a kit, but never one of its three picks.
Pages, features and fixes, with your agent.
From one sentence to a live page, without a template look.
Use Base44Think it through first, then let your agent write tested code.
Use Claude CodeFind the root cause before anyone touches the code.
Use CursorYour branch reviewed, the findings fixed and a description reviewers can follow.
Use CodeRabbit