api-security-hardening

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

1.37x

Quality

85%

Does it follow best practices?

Impact

96%

1.37x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Evaluation results

88%

Secure Nginx Reverse Proxy for a REST API

Nginx reverse proxy security hardening

Criteria

Without this skill

With this skill

TLS protocols

100%

Cipher suites

100%

Server cipher preference

100%

SSL session cache

100%

X-Frame-Options header

100%

X-Content-Type-Options header

100%

X-XSS-Protection header

100%

HSTS header

100%

CSP header

100%

66%

Request body size limit

100%

Client body timeout

100%

Client header timeout

100%

HTTP method blocking

62%

100%

Rate limit zone definition

50%

37%

Rate limit application

100%

28%

HTTP to HTTPS redirect

60%

100%

44%

Secure User Registration API

Express.js API security hardening

Criteria

Without this skill

With this skill

helmet middleware

100%

mongo-sanitize middleware

100%

no xss-clean

100%

general rate limit config

80%

100%

auth rate limit config

40%

100%

email validation

25%

100%

password validation

50%

100%

customSanitizer with escape-html

100%

HTTP 400 on validation failure

37%

100%

no secrets in code

100%

safe error responses

100%

27%

User Directory Service API

FastAPI security hardening

Criteria

Without this skill

With this skill

TrustedHostMiddleware added

100%

CORSMiddleware explicit origins

100%

CORSMiddleware explicit methods

100%

slowapi rate limiter

100%

Security headers middleware

100%

X-Content-Type-Options header

100%

X-Frame-Options header

100%

HSTS header

100%

CSP header

100%

Password min length

100%

Password uppercase requirement

100%

Password digit requirement

100%

Password special char requirement

100%

Query max_length on search param

100%

Array size capped

100%

No detailed error exposure

60%

100%

Repository: secondsky/claude-skills
Path: plugins/api-security-hardening/skills/api-security-hardening/SKILL.md
Commit: a0994f7

Evaluated: 2 months ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Secure User Registration API User Directory Service API Secure Nginx Reverse Proxy for a REST API

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.