input-validation-auditor
Skill0 starsChanged 18 days agoMITView on GitHub
Audit server-side validation at trust boundaries for shape, type, range, format, size, and semantic constraints. Use for APIs, forms, uploads, imports, or external events.
1 other project uses a version of this.
Adopted by
Most recently taken up by
- 45ck/security-engineering-skillstheir own version, first seen Mar 28, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 1
- 45ck/security-engineering-skills★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository42 other files it gives its agents.
- AGENTS.mdAGENTS.md
- completion-claims-auditorSkill
- existing-work-preservationSkill
- mcp-reliability-auditorSkill
- multi-agent-integration-reviewerSkill
- project-context-recoverySkill
- requirement-traceability-auditorSkill
- scope-drift-guardSkill
- architecture-complexity-auditorSkill
- dependency-cycle-auditorSkill
- database-schema-reviewerSkill
- data-consistency-auditorSkill
- migration-safety-reviewerSkill
- loop-breakerSkill
- reproduction-builderSkill
- root-cause-debuggerSkill
- dependency-grounding-auditorSkill
- ci-failure-investigatorSkill
- cross-platform-readiness-auditorSkill
- environment-config-auditorSkill
- environment-parity-auditorSkill
- production-readiness-auditorSkill
- documentation-accuracy-auditorSkill
- token-efficient-workflowSkill
- accessibility-auditorSkill
- dead-feature-detectorSkill
- responsive-design-auditorSkill
- ux-state-completeness-auditorSkill
- release-verification-agentSkill
- agent-tool-trust-auditorSkill
- authentication-security-auditorSkill
- authorization-boundary-auditorSkill
- dependency-vulnerability-auditorSkill
- injection-risk-auditorSkill
- secret-leakage-detectorSkill
- security-misconfiguration-auditorSkill
- api-contract-auditorSkill
- integration-reality-checkerSkill
- missing-test-detectorSkill
- regression-detectorSkill
- test-quality-auditorSkill
- ui-flow-verifierSkill
The file
We split this skill into the rules it gives an agent
8 rules. About 0 are common, 8 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈8
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 8
Ensure malformed or adversarial inputs fail safely before reaching business logic or storage.
- Distinctive: line 16
Only trusted internal values are moved between already-validated components.
- Distinctive: line 20
Read applicable repository instructions before edits.
- Distinctive: line 35
Check upload/file size, content type, decompression/parse limits, and collection bounds where relevant.
- Distinctive: line 36
Test valid boundary values plus missing, malformed, oversized, unexpected, and semantically invalid cases.
- Distinctive: line 37
Verify validation happens before side effects and produces consistent non-sensitive errors.
- Distinctive: line 46
Do not rely on client-side validation as a server security control.
- Distinctive: line 63
If domain constraints are unknown, separate structural validation from the unresolved business-rule questions.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Purpose
Ensure malformed or adversarial inputs fail safely before reaching business logic or storage.
When to activate
External/user-controlled data enters a server process or persistent model.
When not to activate
Only trusted internal values are moved between already-validated components.
Preconditions
- Read applicable repository instructions before edits.
- Preserve unrelated working-tree changes and establish a baseline when the workflow can modify code.
- Identify which tools and environments are actually available; do not claim unavailable checks ran.
Required inputs
- Input schemas/contracts
- Entry points
- Business constraints and persistence model
Workflow
- Enumerate each trust-boundary payload and its authoritative server-side schema.
- Compare required/optional fields, types, ranges, formats, lengths, enum values, and unknown-field handling.
- Identify semantic constraints that schemas alone cannot express, such as date ordering or cross-field invariants.
- Check upload/file size, content type, decompression/parse limits, and collection bounds where relevant.
- Test valid boundary values plus missing, malformed, oversized, unexpected, and semantically invalid cases.
- Verify validation happens before side effects and produces consistent non-sensitive errors.
- Confirm clients and documentation match the server contract.
Relevant tools
Schema validators, API tests, model constraints, documentation.
Safety restrictions
Do not rely on client-side validation as a server security control.
Validation
- Malformed and boundary inputs are rejected before protected side effects.
- Valid boundary values remain accepted.
- Schema/documentation mismatch is resolved or reported.
Expected output
- Validation matrix
- Missing constraints
- Test results
- Contract/documentation deltas
Failure handling
If domain constraints are unknown, separate structural validation from the unresolved business-rule questions.
Completion criteria
The skill is complete only when every applicable validation item above has observed evidence or is explicitly marked not executed with the concrete blocker. Do not replace missing evidence with confidence language.
Research mapping
This skill was selected from research problems: P017. See research/vibe-coding-problems.md and research/problem-evidence.csv in the Vibe Coding Skills repository.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.