Proactive security hardening orchestrator with multi-layer threat mitigation
<codex_skill_adapter>
$security-model-harden.$security-model-harden as {{SC_ARGS}}.{{SC_ARGS}} as empty.spawn_agent(...) patterns to Codex spawn_agent(...).update_plan.config.toml when the original command mentions MCP.security:model:harden.$security-model-harden.STEP 1: Initialize comprehensive security hardening session with threat modeling
/tmp/harden-session-$SESSION_ID.json# Initialize hardening session state
echo '{
"sessionId": "'$SESSION_ID'",
"targetPath": "'{{SC_ARGS}}'",
"projectType": "auto-detect",
"hardeningLevel": "strict",
"threatsIdentified": [],
"mitigationsApplied": [],
"complianceTarget": "general"
}' > /tmp/harden-session-$SESSION_ID.json
STEP 2: Multi-layer threat assessment with parallel security analysis
IF complex_infrastructure_detected OR kubernetes_manifests_found:
LAUNCH parallel sub-agents for comprehensive security assessment:
Agent 1: Container Security Assessment: Analyze Dockerfiles and container configurations
Agent 2: Kubernetes Security Analysis: Evaluate K8s manifests and Pod Security Standards
Agent 3: Application Code Security: Scan source code for security anti-patterns
Agent 4: Infrastructure Security: Analyze deployment and networking security
Agent 5: Compliance Assessment: Evaluate against security frameworks
ELSE:
EXECUTE targeted single-layer hardening based on detected project type
STEP 3: Programmatic security hardening implementation with error handling
TRY:
CASE project_complexity: WHEN "dockerfile_only":
WHEN "kubernetes_deployment":
WHEN "application_code":
WHEN "full_stack_application":
Security Hardening Patterns:
# Container Security Implementation
if fd "Dockerfile" . | head -1 >/dev/null; then
echo "🐳 Applying container security hardening..."
# Multi-stage builds with distroless images
# Non-root user execution
# Read-only root filesystem
# Dropped capabilities
fi
# Kubernetes Security Implementation
if fd "\.ya?ml$" . | rg -l "kind: (Deployment|Pod)" | head -1 >/dev/null; then
echo "☸️ Implementing Kubernetes security policies..."
# Pod Security Standards enforcement
# Network policy generation
# RBAC configuration
# Security context hardening
fi
# Application Security Implementation
project_lang=$(fd "(package\.json|Cargo\.toml|go\.mod|pom\.xml)" . | head -1)
if [[ -n "$project_lang" ]]; then
echo "🔒 Applying application-level security patterns..."
# Security headers middleware
# Input validation frameworks
# Authentication/authorization
# Secure configuration management
fi
CATCH (hardening_failed):
echo "⚠️ Security hardening encountered issues:"
echo "- Check tool availability and permissions"
echo "- Validate target path accessibility"
echo "- Review project structure compatibility"
echo "- Consider manual security review process"
STEP 4: Compliance validation and security documentation generation
FOR EACH security_layer IN ["container", "kubernetes", "application", "infrastructure"]:
Security Documentation Generation:
# Generate comprehensive security documentation
mkdir -p security/{policies,procedures,compliance}
# Security policy documentation
echo "📋 Generating security documentation suite..."
echo " - SECURITY.md: Security policy and procedures"
echo " - threat-model.md: Application threat analysis"
echo " - compliance/: Framework-specific compliance documentation"
echo " - incident-response/: Security incident procedures"
STEP 5: Session state management and continuous security monitoring
Update Hardening Session State:
# Update session with applied mitigations
jq --arg timestamp "$(gdate -Iseconds 2>/dev/null || date -Iseconds)" \
--argjson mitigations '["container_hardening", "k8s_policies", "app_security"]' '
.lastUpdated = $timestamp |
.mitigationsApplied += $mitigations |
.hardeningStatus = "completed"
' /tmp/harden-session-$SESSION_ID.json > /tmp/harden-session-$SESSION_ID.tmp && \
mv /tmp/harden-session-$SESSION_ID.tmp /tmp/harden-session-$SESSION_ID.json
Security Monitoring Setup:
echo "🔍 Security hardening completed successfully"
echo "📊 Session: $SESSION_ID"
echo "🎯 Target: {{SC_ARGS}}"
echo "🛡️ Applied mitigations: $(jq -r '.mitigationsApplied | join(", ")' /tmp/harden-session-$SESSION_ID.json)"
echo "📁 Security documentation: security/ directory"
echo "⚡ Next steps: Review generated policies and implement monitoring"
FINALLY:
This command systematically reduces your application's attack surface by implementing security hardening across multiple layers. Unlike audit-focused tools, /harden makes actual security improvements to your code and infrastructure.
Transforms Docker images to follow security best practices:
Before:
FROM node:18
COPY . /app
WORKDIR /app
RUN npm install
USER root
CMD ["npm", "start"]
After:
# Multi-stage build with distroless final image
FROM node:18-alpine AS builder
WORKDIR /build
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
FROM gcr.io/distroless/nodejs18-debian11:nonroot
COPY --from=builder /build/node_modules /app/node_modules
COPY --from=builder --chown=nonroot:nonroot /build/src /app/src
# Security hardening
USER nonroot
WORKDIR /app
# Read-only root filesystem
COPY --chmod=444 package.json ./
ENV NODE_ENV=production
# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD node healthcheck.js
EXPOSE 3000
CMD ["node", "src/index.js"]
Applied Hardening:
Implements Pod Security Standards and network policies:
Generated Pod Security Context:
apiVersion: apps/v1