api-hardening

Name: api-hardening
Author: jamditis

336stars57forks

How to install api-hardening?

jamditis/claude-skills-journalism/api-hardening

$npx -y skills add jamditis/claude-skills-journalism --skill api-hardening

Installs into the current project.

Summary

API security hardening patterns. Use when implementing rate limiting, input validation, CORS configuration, API key management, request throttling, or protecting endpoints from abuse. Covers defense-in-depth strategies for REST APIs with practical implementations for Express, Fas

Files · 1

View on GitHub

SKILL.md

1	# API hardening
2
3	Defense-in-depth patterns for protecting APIs from abuse, injection attacks, and data leakage. Recipes are oriented around the OWASP API Security Top 10:2023 and were last verified on 2026-05-08.
4
5	## Step 0: Research the current security landscape (do this first)
6
7	> Security knowledge ages on a 6-12 month half-life. The recipes below were last verified on 2026-05-08; they may be stale by the time you read this. Before applying any pattern in this skill, fan out research scoped to the API surface or web defense being added so the recipes are interpreted against current authoritative sources, not against this file's snapshot.
8
9	### Default-on, with a documented skip
10
11	Run the 4-angle research below by default. Skip ONLY when ALL of these hold:
12
13	- (a) You ran this same skill on this same primitive within the last 4 hours of the current session,
14	- (b) That prior research surfaced no urgent advisories for the API surface or web defense being added,
15	- (c) You log a one-line `Research skipped because <reason>` note in your response.
16
17	"I think I know" / "moving fast" / "user wants this done quickly" / "already familiar" are NOT valid skip reasons. The whole point of this preamble is that future-you should not trust this skill body's defaults until current state is checked.
18
19	### Fan out 4 subagents in parallel
20
21	Each subagent returns ≤300 words of bullets with citations. Dispatch all 4 in a single message so they run concurrently.
22
23	Angle 1 — Authoritative standards. Have NIST / OWASP / IETF (RFCs and Internet-Drafts) / W3C / CISA published anything new about the API surface or web defense being added in the last 6-12 months? Look for: spec finalizations, deprecations, replacement specs, RFC publications, draft revisions, NIST SP updates, OWASP project version bumps. Cite by document number + publication date.
24
25	Angle 2 — Active exploitation. What's actively being exploited that targets the API surface or web defense being added? Pull from: CISA Known Exploited Vulnerabilities (KEV) catalog (filter to last 6-12 months), recent CVE / GHSA entries with high CVSS or in-the-wild exploitation, breach postmortems and incident reports (CSRB, vendor RCAs, security-vendor research). Surface CWE patterns dominating recent KEV adds. Cite by CVE number + advisory URL.
26
27	Angle 3 — Tooling and library state. Are the libraries this skill recommends still current? What are the latest major versions in the relevant package registry (npm / PyPI / RubyGems / crates.io)? Have any been deprecated, replaced, or merged into another project? Have any flipped a secure default? Look up current versions in: registry.npmjs.org, pypi.org, rubygems.org, crates.io, pkg.go.dev. Cite by package + version + release date.
28
29	Angle 4 — Practitioner discourse. What are practitioners and security teams talking about in the last 6 months? Pull from: OWASP Cheat Sheet Series (last-modified date matters), GitHub Security Lab posts, vendor security blogs (Cloudflare, Fastly, Snyk, Datadog, Wiz, GitGuardian), conference talks (Black Hat, DEF CON, OWASP Global AppSec, USENIX Security), SANS ISC, Krebs, recent OWASP project re-releases. Surface the patterns being adopted and the anti-patterns being called out. Cite by post URL + author + date.
30
31	### Synthesize before applying recipes
32
33	After the 4 returns land, write a 1-paragraph "current state for the API surface or web defense being added, as of <today's date>" that names:
34
35	- The current normative ceiling (what specs say SHOULD be the default in 2026).
36	- 1-2 active threats specific to the API surface or web defense being added from the last 6-12 months.
37	- Any tooling drift (deprecated lib, new default in a framework, package merged or replaced).
38	- Any practitioner consensus shift visible in recent cheat sheet / blog updates.
39
40	If the synthesis flags drift in this skill body's recipes (e.g., a spec finalized after 2026-05-08, a library now deprecated, a default flipped), call that out explicitly in your response and override the skill body where they conflict. The synthesis wins. The skill body is scaffolding, not scripture.
41
42	### When you cannot run subagents
43
44	If subagents are not available in your runtime, the same shape applies in-line: do 4 sequential targeted searches (web search for standards, KEV catalog lookup, package registry version checks, recent cheat-sheet diff). Land the same 1-paragraph synthesis. Cost goes up; the protection does not change.
45
46	## OWASP API Security Top 10:2023 mapping
47
48	The active edition for API-specific threat modeling is the OWASP API Security Top 10:2023 (https://

People who liked this also viewed

6 picks

Type

api-hardening

336stars57forks

View on GitHub

How to install api-hardening?

jamditis/claude-skills-journalism/api-hardening

$npx -y skills add jamditis/claude-skills-journalism --skill api-hardening

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API hardening
2
3	Defense-in-depth patterns for protecting APIs from abuse, injection attacks, and data leakage. Recipes are oriented around the OWASP API Security Top 10:2023 and were last verified on 2026-05-08.
4
5	## Step 0: Research the current security landscape (do this first)
6
7	> Security knowledge ages on a 6-12 month half-life. The recipes below were last verified on 2026-05-08; they may be stale by the time you read this. Before applying any pattern in this skill, fan out research scoped to the API surface or web defense being added so the recipes are interpreted against current authoritative sources, not against this file's snapshot.
8
9	### Default-on, with a documented skip
10
11	Run the 4-angle research below by default. Skip ONLY when ALL of these hold:
12
13	- (a) You ran this same skill on this same primitive within the last 4 hours of the current session,
14	- (b) That prior research surfaced no urgent advisories for the API surface or web defense being added,
15	- (c) You log a one-line `Research skipped because <reason>` note in your response.
16
17	"I think I know" / "moving fast" / "user wants this done quickly" / "already familiar" are NOT valid skip reasons. The whole point of this preamble is that future-you should not trust this skill body's defaults until current state is checked.
18
19	### Fan out 4 subagents in parallel
20
21	Each subagent returns ≤300 words of bullets with citations. Dispatch all 4 in a single message so they run concurrently.
22
23	Angle 1 — Authoritative standards. Have NIST / OWASP / IETF (RFCs and Internet-Drafts) / W3C / CISA published anything new about the API surface or web defense being added in the last 6-12 months? Look for: spec finalizations, deprecations, replacement specs, RFC publications, draft revisions, NIST SP updates, OWASP project version bumps. Cite by document number + publication date.
24
25	Angle 2 — Active exploitation. What's actively being exploited that targets the API surface or web defense being added? Pull from: CISA Known Exploited Vulnerabilities (KEV) catalog (filter to last 6-12 months), recent CVE / GHSA entries with high CVSS or in-the-wild exploitation, breach postmortems and incident reports (CSRB, vendor RCAs, security-vendor research). Surface CWE patterns dominating recent KEV adds. Cite by CVE number + advisory URL.
26
27	Angle 3 — Tooling and library state. Are the libraries this skill recommends still current? What are the latest major versions in the relevant package registry (npm / PyPI / RubyGems / crates.io)? Have any been deprecated, replaced, or merged into another project? Have any flipped a secure default? Look up current versions in: registry.npmjs.org, pypi.org, rubygems.org, crates.io, pkg.go.dev. Cite by package + version + release date.
28
29	Angle 4 — Practitioner discourse. What are practitioners and security teams talking about in the last 6 months? Pull from: OWASP Cheat Sheet Series (last-modified date matters), GitHub Security Lab posts, vendor security blogs (Cloudflare, Fastly, Snyk, Datadog, Wiz, GitGuardian), conference talks (Black Hat, DEF CON, OWASP Global AppSec, USENIX Security), SANS ISC, Krebs, recent OWASP project re-releases. Surface the patterns being adopted and the anti-patterns being called out. Cite by post URL + author + date.
30
31	### Synthesize before applying recipes
32
33	After the 4 returns land, write a 1-paragraph "current state for the API surface or web defense being added, as of <today's date>" that names:
34
35	- The current normative ceiling (what specs say SHOULD be the default in 2026).
36	- 1-2 active threats specific to the API surface or web defense being added from the last 6-12 months.
37	- Any tooling drift (deprecated lib, new default in a framework, package merged or replaced).
38	- Any practitioner consensus shift visible in recent cheat sheet / blog updates.
39
40	If the synthesis flags drift in this skill body's recipes (e.g., a spec finalized after 2026-05-08, a library now deprecated, a default flipped), call that out explicitly in your response and override the skill body where they conflict. The synthesis wins. The skill body is scaffolding, not scripture.
41
42	### When you cannot run subagents
43
44	If subagents are not available in your runtime, the same shape applies in-line: do 4 sequential targeted searches (web search for standards, KEV catalog lookup, package registry version checks, recent cheat-sheet diff). Land the same 1-paragraph synthesis. Cost goes up; the protection does not change.
45
46	## OWASP API Security Top 10:2023 mapping
47
48	The active edition for API-specific threat modeling is the OWASP API Security Top 10:2023 (https://

People who liked this also viewed

6 picks

Type