Defending Applications

This is the defensive counterpart to pentest skills: it teaches you how to write code that resists exploitation rather than how to break into systems. It covers the full stack of application-layer defenses from classic web vulnerabilities (SQLi, XSS, IDOR, BOLA) through modern auth flows (OAuth 2.0, OIDC, JWT handling) to LLM-specific threats like prompt injection and RAG poisoning. The philosophy is builder-focused with a strong emphasis on observability: every fix must include detection signals and regression tests, not just patches. Use this when reviewing pull requests for security issues, hardening authentication flows, or designing guardrails for AI features. It explicitly delegates offensive testing to pentest skills and infrastructure hardening to provisioning skills, staying focused on application code you control.

Install to Claude Code

npx -y skills add telagod/code-abyss --skill defending-applications --agent claude-code