Individual skill

scanning-input-validation-practices

Scan for input validation vulnerabilities and injection risks. Use when reviewing user input handling. Trigger with 'scan input validation', 'check injection vulnerabilities', or 'validate sanitization'.

plugins/security/input-validation-scanner/skills/scanning-input-validation-practices/SKILL.md

Read pinned source

Source commit 0500b275e963c027f6b410e8c49c0446945c574e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 12, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 2,916
Repository last updated: Nov 12, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai Repository topic
automation Repository topic
claude-code Repository topic
devops Repository topic
mcp Repository topic
ai-agents Repository topic
anthropic Repository topic
claude-code-plugins Repository topic
developer-tools Repository topic
llm Repository topic
security Declared skill tag
scanning-input Declared skill tag
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,482 bytes
SKILL.mdcore · 4,482 bytes
assets/README.mddoc · 316 bytes
assets/codeql_ruleset.qlsasset · 4,524 bytes
assets/semgrep_ruleset.yamlasset · 9,548 bytes
assets/vulnerable-code-examples.mddoc · 4,336 bytes
references/README.mddoc · 67 bytes
scripts/README.mddoc · 485 bytes
scripts/codeql_scan.pyruns · 2,914 bytes
scripts/semgrep_scan.pyruns · 2,918 bytes

Read excerpt

# Input Validation Scanner

## Overview

Scan application source code for missing or insufficient input validation that could lead to injection attacks (SQL, XSS, command injection), buffer overflows, and path traversal vulnerabilities. Analyzes how user-provided data flows from HTTP parameters, form fields, and API inputs through the application to identify locations where sanitization or validation is absent.

## How It Works

1. **Initiate Scan**: The user requests an input validation scan, triggering the skill.
2. **Code Analysis**: The skill uses the input-validation-scanner plugin to analyze the specified codebase or file.
3. **Vulnerability Identification**: The plugin identifies instances where input validation may be missing or insufficient.
4. **Report Generation**: The skill presents a report highlighting potential vulnerabilities and their locations in the code.

## When to Use This Skill