Hardened Server Code Guard

    1

    Turns feature requests into server code that assumes hostile input: validated contracts, hardened auth, injection-proof data access, safe failures.

    Free

    1 useSecurity scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    Hardened Server Code Guard

    Example session with this skill installed

    We're about to ship the merchant onboarding API in /srv/payments-api (FastAPI + Postgres). Endpoints: POST /accounts (creates a sub-merchant, takes user_id, role, email, webhook_url), GET /accounts/{id}/orders with pagination, and a password reset flow that emails a code. Security review is Friday. Go through routes/accounts.py, services/auth_service.py and repositories/order_repo.py, then rewrite the code so every boundary has a typed schema, the webhook_url can't point at internal IPs, SQL is fully parameterized with tenant filtering, tokens are audience-bound, and failures log without leaking PII. Show me the diffs and what still needs infra work.

    • Read your context and instructions
    • Compiled the hardened server code

    Summary

    Hardened the merchant onboarding API before release: 11 violations found across validation, auth, and outbound calls; 9 fixed in-code, 2 queued for infra sign-off.

    MetricBeforeAfter
    Endpoints with typed request schemas2/77/7
    SQL built from raw input strings40
    Outbound webhook URL validationnonescheme + host allowlist + private-IP block
    JWT alg pinning / audience checkmissingRS256, aud+iss enforced, alg none rejected
    Secret-shaped fields in logs60 (redacted)
    Baseline security headerspartialHSTS, CSP, nosniff on all responses

    Key fixes: CreateAccountRequest.parse() now rejects unknown fields and non-enum roles; coupon lookups moved to parameterized queries with a tenant filter; download paths resolve against the allowed root only; errors return invalid_request plus a trace_id, nothing else.

    Next steps

    • Add negative tests: expired/wrong-audience tokens, cross-tenant payloads, oversized bodies
    • Rate-limit password reset by identity and IP; alert on enumeration patterns
    • Move webhook secrets to the managed vault and schedule rotation before launch

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Standard web frameworks often prioritize developer velocity over security, leaving APIs vulnerable to injection and credential abuse. This skill forces a "hostile environment" mindset onto backend development, ensuring every endpoint is hardened before it reaches production.

    What it does

    • Input validation enforces strict schema contracts for all incoming HTTP, RPC, and queue data.
    • Identity enforcement builds hardened authentication paths using memory-hard hashing and asymmetric JWT verification.
    • Data protection prevents SQL injection and cross-tenant leaks through mandatory parameterization and repository-layer filters.
    • SSRF prevention validates outbound request destinations, blocking access to private, loopback, and metadata networks.
    • Secure signaling configures HTTP headers, CORS policies, and safe error responses that hide internal system details.

    How it works

    1. Define the boundary by identifying which trust zones the request crosses and which fields are user-controlled.
    2. Apply schema constraints to validate types, sizes, and semantic rules before any business logic executes.
    3. Implement deny-by-default controls for authorization, ensuring every action is checked for ownership and permissions.
    4. Sanitize side effects by hardening file paths, shell arguments, and outbound client calls against injection.

    Frameworks & tools

    Works across backend stacks including Python (FastAPI, Flask, Django), Node.js (Express, NestJS), and Go. It applies logic for SQL/NoSQL databases, JWT/OAuth2 flows, and cloud-native integrations.

    Why this beats prompting it yourself

    Generic prompts often produce "happy path" code that ignores edge cases like DNS rebinding or timing attacks. This skill systematically applies a security checklist to every function, ensuring defensive patterns like path normalization and rate limiting are never skipped.

    Use cases

    • Hardening a new public-facing REST API against common OWASP Top 10 vulnerabilities.
    • Refactoring legacy authentication logic to use secure session hygiene and MFA.
    • Building a webhook consumer that safely processes outbound requests to untrusted URLs.
    • Preparing a service for a SOC2 or penetration testing audit by implementing standard security headers and logging.

    Known limitations

    Does not provide high-level compliance strategy or legal advice. Logic is restricted to server-side code and does not include frontend UI styling or client-side-only components.

    Examples are in Python and JavaScript, so other stacks need manual mapping of the same rules. It hardens code in place but cannot verify runtime infrastructure such as WAF rules or secret-manager policies.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    1 use

    Times used to date

    Free to use

    No account required to browse

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    • Free with an Agensi account

    Permissions

    File Scopes

    src/**
    server/**
    api/**

    Read and write access to backend source is needed to insert validation, auth, and data-layer hardening; no network or browser access is required.

    Listed1 month ago
    Updated24 days ago

    What's inside

    Frequently Asked Questions

    This skill functions as a security-focused logic layer for your AI agent, enabling it to write backend code that treats all input as hostile and enforces strict trust boundaries by default.

    It is designed to be compatible with any LLM-powered coding agent that supports custom system instructions or skill integrations, specifically targeting backend environments like Python, Node.js, and Go.

    You receive a specialized set of logic constraints and security protocols that can be imported into your agent's environment to instantly upgrade its code generation capabilities.

    Yes, the skill is designed to analyze existing backend functions and rewrite them to include missing security features like path normalization, parameterization, and secure HTTP headers.

    The skill focuses on defensive coding patterns; it does not provide infrastructure-level firewall configurations, legal compliance documentation, or frontend UI security components.

    Purchasing this skill grants you access to all future refinements, ensuring your AI agent stays updated with the latest defenses against evolving OWASP threats and injection techniques.

    No. It raises the quality of code entering review by embedding validation, auth, token, and SSRF defenses at design time, so your audit finds far fewer issues and your fixes land before the report does.

    The rules are language-neutral (schemas, allowlists, parameterized queries, header baselines). Embedded examples are Python and JavaScript, and they map directly onto Go, Java, Ruby, and similar backend stacks.

    It guides the agent to propose hardened diffs for the files you point it at, keeping risky areas like auth flows and data access reviewable before anything lands.

    New in APIs & Backend

    Free