Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/wpgaurav/claude-code-skillsnpx agentmods add skills/wpgaurav/claude-code-skills/hardenWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wpgaurav/claude-code-skills/harden)<a href="https://agentmods.dev/skills/wpgaurav/claude-code-skills/harden"><img src="https://agentmods.dev/badge/skills/wpgaurav/claude-code-skills/harden.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.02264 |
| Opus 5 | $0.00016 | $0.01132 |
| Sonnet 5 | $0.00006 | $0.00453 |
| Haiku 4.5 | $0.00003 | $0.00226 |
Grade A, and why
harden scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to harden — 12 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 360 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Adapted from impeccable by Paul Bakaus, used under the Apache License 2.0. Modified for this collection; see NOTICE.md for what changed.
Strengthen interfaces against edge cases, errors, internationalization issues, and real-world usage scenarios that break idealized designs.
Assess Hardening Needs
Identify weaknesses and edge cases:
-
Test with extreme inputs:
- Very long text (names, descriptions, titles)
- Very short text (empty, single character)
- Special characters (emoji, RTL text, accents)
- Large numbers (millions, billions)
- Many items (1000+ list items, 50+ options)
- No data (empty states)
-
Test error scenarios:
- Network failures (offline, slow, timeout)
- API errors (400, 401, 403, 404, 500)
- Validation errors
- Permission errors
- Rate limiting
- Concurrent operations
-
Test internationalization:
- Long translations (German is often 30% longer than English)
- RTL languages (Arabic, Hebrew)
- Character sets (Chinese, Japanese, Korean, emoji)
- Date/time formats
- Number formats (1,000 vs 1.000)
- Currency symbols
CRITICAL: Designs that only work with perfect data aren't production-ready. Harden against reality.
Hardening Dimensions
Systematically improve resilience:
Text Overflow & Wrapping
Long text handling:
/* Single line with ellipsis */
.truncate {
overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;
}
/* Multi-line with clamp */
.line-clamp {
display: -webkit-box;
-webkit-line-clamp: 3;
-webkit-box-orient: vertical;
overflow: hidden;
}
/* Allow wrapping */
.wrap {
word-wrap: break-word;
overflow-wrap: break-word;
hyphens: auto;
}
Flex/Grid overflow:
/* Prevent flex items from overflowing */
.flex-item {
min-width: 0; /* Allow shrinking below content size */
overflow: hidden;
}
/* Prevent grid items from overflowing */
.grid-item {
min-width: 0;
min-height: 0;
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 360 lines · 32 tokens per session scan A 5239f8239630
harden is a skill published in the GitHub repository wpgaurav/claude-code-skills (3 stars, last pushed 17d ago), licensed MIT. It adds 32 tokens to every session and 2,264 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 92% identical to harden, differing in 12 lines, and is treated as a copy.
Other skills, from other repositories
extract-source-sample
Given the path to a finished content-goose ad-run folder, extract everything that defines that ad — recipe shot list, VO script, characters, voices, world, atom-skills, master mp4 — and emit a source-sample.json in the exact shape the upload-ad-sample skill writes to the Goose Ads library. Also links every character…
speak-human-tw
A Traditional Chinese editing guide for making public-facing writing sound more natural and less machine-generated. It also checks wording associated with Mainland China and half-width punctuation.
lov-add-tool
A workflow for adding a working online tool to an existing website. It covers the tool page, its listing, translations, site map entry, input handling, results, and cost notices when paid services are used.
lov-i18n-check-i18n
A frontend internationalization checker for finding visible text that is hard-coded, missing translation keys, or incorrectly configured for different languages. Internationalization means preparing software to support multiple languages and regional formats.
fec-nextjs-project-standard
A development guide for Next.js 14 and newer projects using App Router, Next.js’s file-based routing system. It covers server-rendered pages, layouts, data loading, middleware, metadata, and server actions.
fec-route-protection
A guide for protecting front-end routes, meaning the pages and URLs of a web application, based on whether someone is signed in and what permissions they have. It covers login checks, role-based access, expired sessions, and redirects.