Individual skill

input-validation-injection

Apply when reviewing or writing code that processes untrusted input, constructs queries or commands, or handles user-supplied data. Covers SQL, LDAP, OS command injection, prototype pollution, and general validation strategy.

skills/input-validation-injection/SKILL.md

Read pinned source

Source commit 7d11c4a8aa4be142a6ea4792604f8a7b39f0d789

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 15
Repository last updated: Aug 24, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agentic-development Repository topic
agentic-workflows Repository topic
ai-agents Repository topic
claude Repository topic
claude-code Repository topic
claude-skills Repository topic
data Derived category
writing Derived category
data-databases Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,976 bytes

Read excerpt


# Input Validation and Injection Defense

Ensure untrusted input is validated and never interpreted as code. Prevent injection across SQL, LDAP, OS commands, templating, and JavaScript runtime object graphs.

## Core Strategy

- Validate early at trust boundaries with positive (allow-list) validation and canonicalization.
- Treat all untrusted input as data, never as code. Use safe APIs that separate code from data.
- Parameterize queries/commands; escape only as last resort and context-specific.

## Validation Playbook

- **Syntactic validation**: enforce format, type, ranges, and lengths for each field.
- **Semantic validation**: enforce business rules (e.g., start <= end date, enum allow-lists).