Security Skill
Application security, server hardening, and secrets management — from OWASP Top 10 mitigations to production WAF configuration.
RULE: Security changes are high-impact. Always show what will change, explain the risk being mitigated, and wait for GO.
🚧 Status: Stub — implementation pending
This reference skill has the structure but the snippet content is still being filled in
(you'll see <!-- TODO --> placeholders below). It activates and tells Claude the topic
exists, but won't yield deep snippets yet.
Want to help? Pick any TODO, write the snippet, open a PR. See CONTRIBUTING.md.
Each contribution moves the skill closer to "Ready" status.
Capabilities
OWASP Top 10
WordPress Hardening
Server Hardening (UFW / fail2ban)
SSL/TLS Configuration
Secrets Management
WAF Configuration
Quick Wins (apply to any server)
fail2ban WordPress jail
# /etc/fail2ban/jail.local
[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/nginx/access.log
maxretry = 5
bantime = 3600
findtime = 600
# /etc/fail2ban/filter.d/wordpress.conf
[Definition]
failregex = ^<HOST> .* "POST /wp-login.php
ignoreregex =
Nginx security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
server_tokens off;
SSH hardening (/etc/ssh/sshd_config)
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers [your-user]
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
1---2name: security3description: Application and server security — OWASP Top 10, WordPress hardening, server hardening (UFW/fail2ban), SSL/TLS, secrets management, WAF4---56# Security Skill78Application security, server hardening, and secrets management — from OWASP Top 10 mitigations to production WAF configuration.910**RULE: Security changes are high-impact. Always show what will change, explain the risk being mitigated, and wait for GO.**1112> **🚧 Status: Stub — implementation pending**13>14> This reference skill has the structure but the snippet content is still being filled in15> (you'll see `<!-- TODO -->` placeholders below). It activates and tells Claude the topic16> exists, but won't yield deep snippets yet.17>18> **Want to help?** Pick any TODO, write the snippet, open a PR. See [CONTRIBUTING.md](../../CONTRIBUTING.md).19> Each contribution moves the skill closer to "Ready" status.2021---2223## Capabilities2425### OWASP Top 1026<!-- TODO: Injection (SQL, command, LDAP) — prevention patterns per language -->27<!-- TODO: Broken access control — authz checks, IDOR prevention -->28<!-- TODO: Cryptographic failures — hashing (bcrypt/argon2), encryption at rest -->29<!-- TODO: XSS — CSP headers, output encoding, DOMPurify -->30<!-- TODO: Security misconfiguration — headers audit, error message leakage -->31<!-- TODO: Vulnerable components — npm audit, pip-audit, Dependabot -->3233### WordPress Hardening34<!-- TODO: DISALLOW_FILE_EDIT, disable XML-RPC, hide WP version -->35<!-- TODO: Block /wp-login.php by IP at Nginx level -->36<!-- TODO: User enumeration prevention (?author=1 block) -->37<!-- TODO: Database prefix, secrets in wp-config.php above webroot -->38<!-- TODO: File permission hardening (644 files, 755 dirs, 600 wp-config) -->3940### Server Hardening (UFW / fail2ban)41<!-- TODO: UFW rules: default deny, SSH rate limiting -->42<!-- TODO: fail2ban jails: sshd, nginx-http-auth, wordpress -->43<!-- TODO: SSH hardening: key-only, disable root, port change, AllowUsers -->44<!-- TODO: Disable unused services, remove default accounts -->45<!-- TODO: Automatic security updates (unattended-upgrades) -->4647### SSL/TLS Configuration48<!-- TODO: TLS 1.2+ only, disable TLS 1.0/1.1 -->49<!-- TODO: Cipher suite hardening (Mozilla SSL Config Generator) -->50<!-- TODO: HSTS header with preload, OCSP stapling -->51<!-- TODO: Certificate transparency, CAA DNS records -->5253### Secrets Management54<!-- TODO: AWS Secrets Manager vs SSM Parameter Store — when to use each -->55<!-- TODO: Never in env files committed to git, never in Docker args -->56<!-- TODO: External Secrets Operator for Kubernetes -->57<!-- TODO: Secret rotation patterns, break-glass procedures -->5859### WAF Configuration60<!-- TODO: AWS WAF rules: managed rule groups, rate limiting, geo-blocking -->61<!-- TODO: Nginx WAF (ModSecurity + OWASP Core Rule Set) -->62<!-- TODO: Cloudflare WAF rules, challenge vs block -->6364---6566## Quick Wins (apply to any server)6768### fail2ban WordPress jail69```ini70# /etc/fail2ban/jail.local71[wordpress]72enabled = true73filter = wordpress74logpath = /var/log/nginx/access.log75maxretry = 576bantime = 360077findtime = 6007879# /etc/fail2ban/filter.d/wordpress.conf80[Definition]81failregex = ^<HOST> .* "POST /wp-login.php82ignoreregex =83```8485### Nginx security headers86```nginx87add_header X-Frame-Options "SAMEORIGIN" always;88add_header X-Content-Type-Options "nosniff" always;89add_header X-XSS-Protection "1; mode=block" always;90add_header Referrer-Policy "strict-origin-when-cross-origin" always;91add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;92add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;93server_tokens off;94```9596### SSH hardening (/etc/ssh/sshd_config)97```98PermitRootLogin no99PasswordAuthentication no100PubkeyAuthentication yes101AllowUsers [your-user]102MaxAuthTries 3103ClientAliveInterval 300104ClientAliveCountMax 2105```106107<!-- TODO: Add full interactive workflows for each capability above -->
veekunth217