/harden

allowed-tools: Task, Read, Write, Edit, MultiEdit, Bash(fd:*), Bash(rg:*), Bash(docker:*), Bash(kubectl:*), Bash(jq:*), Bash(gdate:*)
name: "Harden"
description: "Proactive security hardening orchestrator with multi-layer threat mitigation"
author: "wcygan"
tags: ["security","model"]
version: "1.0.0"
created_at: "2025-07-14T00:00:00Z"
updated_at: "2025-07-14T00:00:00Z"

Context

• Session ID: !`gdate +%s%N 2>/dev/null || date +%s%N 2>/dev/null || echo "$(date +%s)$(jot -r 1 100000 999999 2>/dev/null || shuf -i 100000-999999 -n 1 2>/dev/null || echo $RANDOM$RANDOM)"`
• Target path: $ARGUMENTS
• Current directory: !`pwd`
• Project type detection: !`fd "(Dockerfile|docker-compose\.yml|Cargo\.toml|go\.mod|package\.json|pom\.xml|build\.gradle)" . -d 3 | head -5 || echo "No build files detected"`
• Container presence: !`fd "Dockerfile" . -d 2 | head -3 || echo "No Dockerfiles found"`
• Kubernetes manifests: !`fd "\.ya?ml$" . | rg -l "(apiVersion|kind):" | head -3 || echo "No K8s manifests detected"`
• Security tools status: !`echo "docker: $(which docker >/dev/null && echo ✓ || echo ✗) | kubectl: $(which kubectl >/dev/null && echo ✓ || echo ✗) | rg: $(which rg >/dev/null && echo ✓ || echo ✗)"`
• Git repository status: !`git status --porcelain 2>/dev/null | wc -l | tr -d ' ' | xargs -I {} echo "Modified files: {}" || echo "Not a git repository"`

Your Task

STEP 1: Initialize comprehensive security hardening session with threat modeling

• CREATE session state: `/tmp/harden-session-$SESSION_ID.json`
• ANALYZE target scope from Context section
• DETERMINE security complexity based on project structure
• VALIDATE required security tools availability

# Initialize hardening session state
echo '{
  "sessionId": "'$SESSION_ID'",
  "targetPath": "'$ARGUMENTS'",
  "projectType": "auto-detect",
  "hardeningLevel": "strict",
  "threatsIdentified": [],
  "mitigationsApplied": [],
  "complianceTarget": "general"
}' > /tmp/harden-session-$SESSION_ID.json

STEP 2: Multi-layer threat assessment with parallel security analysis

IF complex_infrastructure_detected OR kubernetes_manifests_found:

LAUNCH parallel sub-agents for comprehensive security assessment:

• **Agent 1: Container Security Assessment**: Analyze Dockerfiles and container configurations
• Focus: Base image vulnerabilities, privilege escalation, filesystem security
• Tools: Docker security scanning, distroless alternatives, multi-stage optimization
• Output: Container hardening recommendations and secure Dockerfile templates

• **Agent 2: Kubernetes Security Analysis**: Evaluate K8s manifests and Pod Security Standards
• Focus: RBAC policies, network policies, security contexts, admission controllers
• Tools: kubectl security validation, OPA Gatekeeper policies, PSS compliance
• Output: Secure manifest templates and policy enforcement rules

• **Agent 3: Application Code Security**: Scan source code for security anti-patterns
• Focus: Input validation, authentication, authorization, cryptographic usage
• Tools: Static analysis, dependency scanning, secret detection
• Output: Code-level security improvements and secure coding patterns

• **Agent 4: Infrastructure Security**: Analyze deployment and networking security
• Focus: Network segmentation, service mesh security, ingress/egress controls
• Tools: Network policy generation, TLS configuration, certificate management
• Output: Infrastructure security policies and network hardening

• **Agent 5: Compliance Assessment**: Evaluate against security frameworks
• Focus: SOC 2, PCI DSS, HIPAA, CIS benchmarks compliance requirements
• Tools: Compliance mapping, audit trail generation, policy documentation
• Output: Compliance gap analysis and remediation roadmap

ELSE:

EXECUTE targeted single-layer hardening based on detected project type

STEP 3: Programmatic security hardening implementation with error handling

TRY:

CASE project_complexity: WHEN "dockerfile_only":

• APPLY container security hardening patterns
• IMPLEMENT distroless base images and non-root execution
• ADD security scanning and vulnerability management
• GENERATE secure multi-stage build configurations

WHEN "kubernetes_deployment":

• ENFORCE Pod Security Standards (restricted profile)
• IMPLEMENT network policies for micro-segmentation
• CONFIGURE RBAC with principle of least privilege
• ADD security contexts and resource constraints

WHEN "application_code":

• INJECT security middleware and headers
• IMPLEMENT input validation and sanitization
• ADD authentication and authorization frameworks
• CONFIGURE secure session management

WHEN "full_stack_application":

• COORDINATE multi-layer security implementation
• APPLY defense-in-depth strategies
• IMPLEMENT comprehensive logging and monitoring
• CONFIGURE incident response procedures

**Security Hardening Patterns:**

# Container Security Implementation
if fd "Dockerfile" . | head -1 >/dev/null; then
  echo "🐳 Applying container security hardening..."
  # Multi-stage builds with distroless images
  # Non-root user execution
  # Read-only root filesystem
  # Dropped capabilities
fi

# Kubernetes Security Implementation  
if fd "\.ya?ml$" . | rg -l "kind: (Deployment|Pod)" | head -1 >/dev/null; then
  echo "☸️ Implementing Kubernetes security policies..."
  # Pod Security Standards enforcement
  # Network policy generation
  # RBAC configuration
  # Security context hardening
fi

# Application Security Implementation
project_lang=$(fd "(package\.json|Cargo\.toml|go\.mod|pom\.xml)" . | head -1)
if [[ -n "$project_lang" ]]; then
  echo "🔒 Applying application-level security patterns..."
  # Security headers middleware
  # Input validation frameworks
  # Authentication/authorization
  # Secure configuration management
fi

CATCH (hardening_failed):

• LOG detailed error information to session state
• PROVIDE alternative hardening strategies
• SUGGEST manual security review steps
• GENERATE partial security impro