security-and-hardening
Use for trust boundaries, untrusted input, auth, secrets, sensitive data, or external writes.
Skill by shiyuan17
Chalk Labs
Need help deploying security-and-hardening?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/shiyuan17-security-and-hardening
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: data, security
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/security-and-hardening
What's inside
- Skill name
security-and-hardening- Description
- Use for trust boundaries, untrusted input, auth, secrets, sensitive data, or external writes.
- License
- MIT
- Instructions
- 16 lines in SKILL.md · view on GitHub
Files (3)
- SKILL.md
- openai.yaml · agents/
- metadata.json
SKILL.md (first lines)
# 加固安全边界 ## 执行 1. 识别资产、信任边界、攻击者能力和失败影响。 2. 在入口执行结构与语义校验，在服务端强制认证和授权。 3. 使用参数化查询、最小权限、受限路径和安全默认值。 4. 禁止 secret 进入代码、日志、错误响应、测试快照或持久化上下文。 5. 为拒绝路径、越权、注入、路径逃逸和敏感信息泄漏增加测试。 6. 生产、凭据、外部写入或不可逆动作前，核对授权是否覆盖实际目标、环境、写入范围、effect 和终点；已有覆盖授权不重复确认，只有缺授权或新增风险时请求批准。核对工作区路径、Git 目录、分支、基线 SHA 与 allowedWriteRoots；高风险还须由宿主提供 filesystem、approval、process=isolated、network、observedAt，source=host。Agent 不得自造核验信息；缺失时暂停受影响操作，保留现场和独立的安全工作，不重试绕过或自行放宽控制。同步归属：`docs/rules/governance-core.md`。 ## 交付 报告威胁、控制措施、验证证据、审批状态和残余风险。 ## 正反例 - 该用：新增外部输入入口、认证授权、凭据处理、敏感数据或外部写入。 - 不该用：不改变信任边界的纯本地文案、样式或注释调整。 - 授权缺失：缺宿主证明或红区确认时暂停受影响操作并保留现场，不用「看起来安全」代替批准，也不重试绕过；未触发的控制项如实标注未验证。
From shiyuan17/Vibe-Harness, MIT.
More from shiyuan17/Vibe-Harness
- 0.570score
agentmemory
shiyuan17
Use when saving, recalling, resuming, forgetting, summarizing, or listing Agentmemory project memories and sessions, including commit history and commit…
SkillAFreshness: AClaude Code +9 - 0.570score
stale-cleanup
shiyuan17
Use when cleaning dead code, stale references, outdated docs, orphan resources, stale memory, or stale indexes; producing evidence-based removal lists; or…
SkillAFreshness: AClaude Code +9 - 0.567score
clarify-requirements
shiyuan17
Use for unresolved product choices or explicit requirements discovery—not discoverable facts, implementation details, approvals, or final goals.
SkillAFreshness: AClaude Code +9 - 0.565score
systematic-debugging
shiyuan17
Use when a specific failure, error, or flaky test needs its root cause proven before fixing—not for applying known fixes.
SkillAFreshness: AClaude Code +9 - 0.564score
frontend-design
shiyuan17
Use for frontend visual direction, polish, responsiveness, or redesign—not logic-only work.
SkillAFreshness: AClaude Code +9 - 0.564score
define-goal
shiyuan17
Use to write, refine, or activate `/goal` or execution/exploration objectives—not goal status operations.
SkillAFreshness: AClaude Code +9 - 0.561score
eval-driven-development
shiyuan17
Use for nondeterministic Agent rules, Skills, prompts, Hooks, or routing—not deterministic logic, bug fixes with known causes, or deterministic refactors.
SkillAFreshness: AClaude Code +9 - 0.561score
vb-git-develop-flow
shiyuan17
Use only when explicitly requested as Vb Git Develop Flow, $vb-git-develop-flow, or legacy gd-flow to deliver through an isolated worktree into develop; never…
SkillAFreshness: AClaude Code +9 - 0.561score
vb-git-split-push
shiyuan17
Use only when explicitly requested as Vb Git Split Push, $vb-git-split-push, or legacy $git-deliver to commit task changes in logical groups and push the…
SkillAFreshness: AClaude Code +9 - 0.559score
bug-finding
shiyuan17
Use when reviewing existing code for latent logic, flow, feature, state, consistency, requirement, or API bugs with no failing symptom—read-only audit, not…
SkillAFreshness: AClaude Code +9 - 0.558score
api-and-interface-design
shiyuan17
Use for public APIs, schemas, events, config, or consumed module boundaries.
SkillAFreshness: AClaude Code +9 - 0.558score
task-decomposition
shiyuan17
Use to split implementation plans into a Goal, Task DAG, and prompts for verifiable work.
SkillAFreshness: AClaude Code +9
Signals
- Stars
- 0
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Oct 14, 2026 (18 days ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- Repository
- github.com/shiyuan17/Vibe-Harness
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from shiyuan17
- 0.570score
agentmemory
shiyuan17
Use when saving, recalling, resuming, forgetting, summarizing, or listing Agentmemory project memories and sessions, including commit history and commit…
SkillAFreshness: AClaude Code +9 - 0.570score
stale-cleanup
shiyuan17
Use when cleaning dead code, stale references, outdated docs, orphan resources, stale memory, or stale indexes; producing evidence-based removal lists; or…
SkillAFreshness: AClaude Code +9 - 0.567score
clarify-requirements
shiyuan17
Use for unresolved product choices or explicit requirements discovery—not discoverable facts, implementation details, approvals, or final goals.
SkillAFreshness: AClaude Code +9 - 0.565score
systematic-debugging
shiyuan17
Use when a specific failure, error, or flaky test needs its root cause proven before fixing—not for applying known fixes.
SkillAFreshness: AClaude Code +9 - 0.564score
define-goal
shiyuan17
Use to write, refine, or activate `/goal` or execution/exploration objectives—not goal status operations.
SkillAFreshness: AClaude Code +9 - 0.564score
frontend-design
shiyuan17
Use for frontend visual direction, polish, responsiveness, or redesign—not logic-only work.
SkillAFreshness: AClaude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get security-and-hardening running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
security-and-hardening skill. Agent Mart. https://agentmart.dev/skills/shiyuan17-security-and-hardening (last updated 2026-10-24)