Defending Applications

This is the defensive counterpart to pentest skills: it teaches you how to write code that resists exploitation rather than how to break into systems. It covers the full stack of application-layer defenses from classic web vulnerabilities (SQLi, XSS, IDOR, BOLA) through modern auth flows (OAuth 2.0, OIDC, JWT handling) to LLM-specific threats like prompt injection and RAG poisoning. The philosophy is builder-focused with a strong emphasis on observability: every fix must include detection signals and regression tests, not just patches. Use this when reviewing pull requests for security issues, hardening authentication flows, or designing guardrails for AI features. It explicitly delegates offensive testing to pentest skills and infrastructure hardening to provisioning skills, staying focused on application code you control.

GitHub stars: 224
last updated: Jun 10, 2026

View on GitHub

Install

$ npx -y skills add telagod/code-abyss --skill defending-applications --agent claude-code

Installs into .claude/skills of the current project.

Files

应用安全防御 · 镇魔甲

判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

开发侧防御秘典：站在 builder 一侧，把漏洞挡在合并前。不教渗透，只教"如何写出杀不动的代码"和"如何把已生漏洞最小代价闭环"。信级：项目源码/lock 文件 > 框架官方安全文档 > CVE/CWE > 训练记忆（标 [unverified]）。

路由

意图	加载	触发词
Web/API/GraphQL 漏洞防御	web-api-appsec	XSS, SQLi, SSRF, BOLA, IDOR, Mass Assignment, GraphQL, 反序列化, 文件上传, 路径遍历, XXE, OWASP
认证授权与会话	oauth-and-sessions	OAuth, OIDC, JWT, SSO, SAML, Session, Cookie, PKCE, refresh token, kid 注入
LLM 应用安全	llm-appsec	Prompt 注入, 越狱, 越权调用, RAG 投毒, agent tool 滥用, 输出过滤, jailbreak