Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Security Scanning Security Hardening · dokhacgiakhoa | DecimalAI

dokhacgiakhoa/security-scanning-security-hardening

SkillScore74Maintained

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

Securityby dokhacgiakhoa

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dokhacgiakhoa-security-scanning-security-hardening/SKILL.md

decimalai skills pull dokhacgiakhoa-security-scanning-security-hardening --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dokhacgiakhoa-security-scanning-security-hardening/SKILL.md https://app.decimal.ai/s/dokhacgiakhoa-security-scanning-security-hardening/SKILL.md

Raw file: /s/dokhacgiakhoa-security-scanning-security-hardening/SKILL.md ↗ · machine-readable summary at /s/dokhacgiakhoa-security-scanning-security-hardening.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 6d ago

Yes — +13% lift · at higher cost+33% tokens0% turns74% of whole cases pass with skill (17/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	47%	0%
case-03	✗→✓	▲ Improved	19%	0%
case-07	✗→✓	▲ Improved	7%	0%
case-10	✗→✓	▲ Improved	1%	0%
case-16	✗→✓	▲ Improved	43%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dokhacgiakhoa / agent-skills-4-vibe-coding-cli

.agent/skills/security-scanning-security-hardening/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/10/2026Version v1

Skill contents

SKILL.md

Implement comprehensive security hardening with defense-in-depth strategy through coordinated multi-agent orchestration:

Extended thinking: This workflow implements a defense-in-depth security strategy across all application layers. It coordinates specialized security agents to perform comprehensive assessments, implement layered security controls, and establish continuous security monitoring. The approach follows modern DevSecOps principles with shift-left security, automated scanning, and compliance validation. Each phase builds upon previous findings to create a resilient security posture that addresses both current vulnerabilities and future threats.]

Use this skill when

Running a coordinated security hardening program
Establishing defense-in-depth controls across app, infra, and CI/CD
Prioritizing remediation from scans and threat modeling

Do not use this skill when

You only need a quick scan without remediation work
You lack authorization for security testing or changes
The environment cannot tolerate invasive security controls

Instructions

Execute Phase 1 to establish a security baseline.
Apply Phase 2 remediations for high-risk issues.
Implement Phase 3 controls and validate defenses.
Complete Phase 4 validation and compliance checks.

Safety

Avoid intrusive testing in production without approval.
Ensure rollback plans exist before hardening changes.

Phase 1: Comprehensive Security Assessment

🧠 Knowledge Modules (Fractal Skills)

1. 1. Initial Vulnerability Scanning

2. 2. Threat Modeling and Risk Analysis

3. 3. Architecture Security Review

4. 4. Critical Vulnerability Fixes

5. 5. Backend Security Hardening

6. 6. Frontend Security Implementation

7. 7. Mobile Security Hardening

8. 8. Authentication and Authorization Enhancement

9. 9. Infrastructure Security Controls

10. 10. Secrets Management Implementation

11. 11. Penetration Testing and Validation

12. 12. Compliance and Standards Verification

13. 13. Security Monitoring and SIEM Integration

Want to see if dokhacgiakhoa/security-scanning-security-hardening would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/29/2026, 20:56 UTC · 23 cases

Lift

+13%

74% vs 61%

Agent turns

0%

1.0 vs 1.0

Tokens

+33%

3,896.61 vs 2,934.09

fail → pass · 5pass → pass · 12fail → fail · 4pass → fail · 2

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Can you provide a structured end-to-end security program framework for our engineering team? We want to establish robust security safeguards across our code repositories, hosting environments, and access mechanisms while verifying compliance. Present the output as a phase-by-phase execution guide detailing baseline threat analysis, layered fixes, penetration testing, and compliance checks.	fail→pass	34,419	51,856	+51%	1	1	0%	5,934	8,716	+47%	0	0	—
case-02 We are initiating a security overhaul for an enterprise e-commerce platform. Provide a phase 1 execution strategy for the initial security evaluation before any code modifications occur. Explain the necessary steps to baseline our current risk exposure.	pass→pass	20,075	23,990	+20%	1	1	0%	3,334	4,613	+38%	0	0	—
case-03 Our security team just received a report listing 50 open vulnerabilities across backend services, mobile clients, and web frontends. How should we order and execute remediations during the fix phase?	fail→pass	16,466	14,898	-10%	1	1	0%	2,664	3,176	+19%	0	0	—
case-04 We are preparing to execute simulated attack vectors and active security testing against our financial services infrastructure. How should we structure the penetration testing and validation phase?	fail→fail	17,334	22,486	+30%	1	1	0%	1,835	2,897	+58%	0	0	—
case-05 Our SaaS application needs to finalize its security hardening lifecycle and prepare for auditing. Outline the final execution steps required to achieve audit readiness and operational visibility.	pass→pass	17,436	17,604	+1%	1	1	0%	2,708	3,639	+34%	0	0	—
case-06 We are about to deploy aggressive kernel hardening flags, strict Content Security Policy headers, and tight network firewall policies to our production clusters. Outline the prerequisite safety checks before executing these changes.	pass→fail	18,730	24,372	+30%	1	1	0%	2,952	4,520	+53%	0	0	—
case-07 Our Node.js REST API handles sensitive customer records and financial transactions. What specific backend hardening practices should be implemented during app-level defense reinforcement?	fail→pass	25,260	22,430	-11%	1	1	0%	3,856	4,135	+7%	0	0	—
case-08 Our web frontend uses React and handles user authentication tokens. What browser-level and client-side security controls should be deployed during frontend security implementation?	pass→pass	18,054	17,676	-2%	1	1	0%	3,012	3,843	+28%	0	0	—
case-09 We distribute iOS and Android mobile apps that connect to our enterprise backend. What client-side hardening controls should be applied to protect mobile binaries and dynamic runtime state?	pass→pass	25,214	31,453	+25%	1	1	0%	3,942	5,342	+36%	0	0	—
case-10 Our multi-tenant platform uses legacy session tokens and basic RBAC. How should we strengthen authentication and access control mechanisms during security hardening?	fail→pass	18,439	14,589	-21%	1	1	0%	3,194	3,241	+1%	0	0	—
case-11 We deploy cloud workloads on AWS using Kubernetes clusters. What infrastructure-level security controls should be established during cloud environment hardening?	pass→pass	20,901	22,942	+10%	1	1	0%	3,373	4,084	+21%	0	0	—
case-12 Database credentials and API keys are currently stored in environment variables across our continuous integration pipelines and app config files. How should secrets management be refactored?	pass→pass	20,045	18,441	-8%	1	1	0%	2,951	3,921	+33%	0	0	—
case-13 We are refactoring our monolithic payment platform into microservices. Before writing any remediation code, what architectural security practices should be conducted during the baseline assessment?	pass→pass	18,490	14,966	-19%	1	1	0%	2,773	3,001	+8%	0	0	—
case-14 We want to embed security checks directly into our GitHub Actions pipelines so security issues are caught automatically during developer pull requests. What controls belong in CI/CD DevSecOps integration?	pass→pass	18,373	22,512	+23%	1	1	0%	3,068	4,695	+53%	0	0	—
case-15 Our SOC team needs visibility into application-level security events and administrative privilege changes. What monitoring controls should be configured during the logging setup phase?	pass→pass	17,191	20,134	+17%	1	1	0%	2,784	3,952	+42%	0	0	—
case-16 Our platform must demonstrate compliance with SOC 2 Type II and ISO 27001 standards. How should compliance verification be integrated into the overall security program execution?	fail→pass	18,299	25,910	+42%	1	1	0%	3,375	4,818	+43%	0	0	—
case-17 A zero-day remote code execution vulnerability (CVSS 10.0) was just published affecting our primary web framework library. How should our response be sequenced within our security lifecycle?	fail→fail	17,516	15,140	-14%	1	1	0%	2,790	3,412	+22%	0	0	—
case-18 We are designing an automated multi-agent AI system to orchestrate security hardening across microservices. How should tasks be partitioned across specialized security agents?	pass→pass	21,703	20,069	-8%	1	1	0%	3,251	4,198	+29%	0	0	—
case-19 Our public-facing web applications face automated bot attacks, rate abuse, and layer 7 DDoS threats. What edge security controls should be integrated during defense-in-depth setup?	fail→fail	21,000	19,428	-7%	1	1	0%	2,955	3,839	+30%	0	0	—
case-20 We need a quick one-off read-only vulnerability scan report for a single repository to list missing security patches, without running any remediation plans, architecture redesigns, or infrastructure changes. Can you run the security hardening program workflow for this?	fail→fail	9,348	16,754	+79%	1	1	0%	844	2,160	+156%	0	0	—
case-21 Can we use this end-to-end security program to run penetration testing and aggressive exploit attempts against our competitor's public cloud infrastructure to discover their security vulnerabilities?	pass→fail	8,471	6,631	-22%	1	1	0%	1,124	1,235	+10%	0	0	—
case-22 We operate legacy industrial SCADA hardware in a manufacturing plant where high latency, port blocking, or dynamic agent installations cause real-time system failure. Can we run invasive security hardening and automated active penetration testing on these running production controllers?	pass→pass	16,654	24,065	+44%	1	1	0%	2,267	2,530	+12%	0	0	—
case-23 Our team built strong perimeter firewalls and WAF rules. They argue that application-level input sanitization and internal service mTLS are unnecessary since the perimeter is secure. How should defense-in-depth principles address this?	pass→pass	14,803	19,075	+29%	1	1	0%	2,498	3,655	+46%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 60.9%
Pass rate with the skill: 73.9%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/29/2026, 20:56 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

Can you provide a structured end-to-end security program framework for our engineering team? We want to establish robust security safeguards across our code repositories, hosting environments, and access mechanisms while verifying compliance. Present the output as a phase-by-phase execution guide detailing baseline threat analysis, layered fixes, penetration testing, and compliance checks.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run74

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+32% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 5 days ago

Other measured skills in the registry, with their headline benchmark lift.