SECURITY2 Multi-file Components

Defensive Web Security & SSRF Prevention Engine

Provides autonomous coding agents with rigorous automated and manual testing rules to audit API routes, webhook receivers, file upload pipelines, and external fetch wrappers against OWASP Top 10 vulnerabilities.

Author: TRIHEX Security Lab

•

License: MIT

•

Version: 1.4.0

Inert Code Verified · Heuristic Static Security ScannerHeuristic Scanner: LOW Risk

Heuristic static security scanner audited 2 files (2540 bytes). External code. Review before execution.

v1.4.0

Skill Files (2)

Compatible Runtimes

AntigravityClaude CodeCursor

SKILL.md·markdown

# Defensive Web Security & SSRF Audit

## Threat Models Covered
1. **Server-Side Request Forgery (SSRF)**: Ensure all outgoing HTTP requests validate URL schemes, reject private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, 169.254.169.254), and enforce max download limits.
2. **Cryptographic Key Exposure**: Scan for hardcoded API keys, JWT secret phrases, and unencrypted fulfillment tokens.
3. **Prompt Injection in LLM Ingestion**: Treat untrusted third-party summaries as inert plain strings. Neutralize instruction override markers.
4. **Session Hijacking**: Verify all auth cookies specify `HttpOnly`, `Secure`, and `SameSite=Lax`.