input-validation

Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)

Ir a la instalación

Repositorio: Tyler-R-Kendrick/agent-skills
Última actividad en el origen: 11 de febrero de 2026 a las 05:14
Idioma detectado de SKILL.md: inglés
Estrellas: 10
Forks: 4

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Tyler-R-Kendrick/agent-skills --skill input-validation

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

14 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

improve

Use when producing agent/LLM evals, synthetic simulation data, or self-improvement pipelines for prompts, code, skills, agents, harnesses, and workflows. Covers AgentEvals/AgentV, Agent Skills evals, ASSERT, GEPA, Trace, VISTA, Agent Lightning, SkillOpt, Simula-style data design, progressive disclosure, deterministic workspaces, and release evidence. USE FOR: eval creation, EVAL.yaml, AgentEvals, AgentV, evals.json, ASSERT, judge-traces, behavior taxonomy, judges, graders, rubrics, synthetic data, simulation data, Simula, QDC, source-grounded generation, prompt optimization, agent improvement, skill improvement, harness hardening, progressive disclosure, deterministic workflows, GEPA, Trace, VISTA, Agent Lightning, SkillOpt DO NOT USE FOR: ordinary unit/integration tests without AI quality criteria (use testing), refactoring without eval or trace feedback (use refactor), generic Agent Skills packaging without eval or improvement work (use agent-skills)

2026-06-09

Use when working with AI agent protocols, standards, interoperability specifications, evaluation contracts, synthetic simulation data, improvement pipelines, and agent steering workflows. Covers MCP, A2A, ACP, Agent Skills, AGENTS.md, ADL, Improve, x402, AP2, MCP Apps, cagent, and learn. USE FOR: agent protocol selection, comparing MCP vs A2A vs ACP, understanding agent standards ecosystem, choosing payment protocols, choosing eval standards, choosing improvement techniques, choosing synthetic data simulation techniques, steering from user feedback DO NOT USE FOR: specific protocol, eval, or improvement implementation details (use the sub-skills: mcp, a2a, acp, improve, learn, x402, etc.)

2026-06-09

learn

Use when a user corrects, rejects, edits, or redirects an LLM/agent response and the correction should become a reusable reasoning strategy. Converts feedback into generalized learnings for ~/.agents/STEERING.md with linked RDF/Turtle evidence. USE FOR: user corrections, preference feedback, rejected agent behavior, reasoning strategy updates, steering file maintenance DO NOT USE FOR: storing task facts (use memory), ordinary skill authoring (use agent-skills), project instruction files unrelated to feedback (use agents-md)

2026-06-08

Ver todos los de este repositorio

name	input-validation
description	Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)
license	MIT
metadata	{"displayName":"Input Validation & Output Encoding","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Input Validation Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html"},{"title":"OWASP Cross-Site Scripting Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"},{"title":"OWASP SQL Injection Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"}]

Data Type	Validation Rule	Example
Strings	Max length, allowed character set, regex pattern	Username: `^[a-zA-Z0-9_]{3,30}$`
Numbers	Type check, min/max range, integer vs. float	Age: integer, 0-150
Emails	RFC 5322 format validation + DNS MX record check	`user@example.com` — verify domain has MX records
URLs	Scheme allowlist (https only), reject internal/private IPs	Allow `https://` only; block `file://`, `javascript:`, RFC 1918 ranges
File uploads	MIME type check (magic bytes, not extension), max size, rename to random, virus scan	Accept `image/png` up to 5MB; rename to UUID; scan with ClamAV
Dates	Strict format parsing (ISO 8601), valid range check	`2024-01-15` — reject `0000-00-00`, far-future dates

Context	Encoding Method	Example
HTML body	HTML entity encode	`<script>` becomes `<script>`
HTML attributes	HTML attribute encode	`" onclick="alert(1)` becomes `" onclick="alert(1)`
JavaScript	JavaScript encode / `JSON.stringify()`	Embed user data only via `JSON.stringify()` into a variable assignment
URL parameters	URL encode (percent-encoding)	`param=hello world` becomes `param=hello%20world`
CSS	CSS hex encode	`</style>` becomes `\003c\002fstyle\003e`
SQL	Parameterized queries ONLY	Never encode manually for SQL — always use prepared statements

Attack	Root Cause	Prevention
SQL injection	String concatenation in SQL queries	Parameterized queries / prepared statements
XSS (Cross-Site Scripting)	Unencoded user data in HTML output	Context-specific output encoding; Content Security Policy (CSP)
Command injection	String concatenation in shell commands	Avoid shell execution; use language APIs with argument arrays
Path traversal	Unvalidated file paths from user input	Canonicalize paths; validate against an allowed base directory
LDAP injection	Unescaped user input in LDAP queries	LDAP-specific escaping functions; parameterized LDAP queries
XML injection	Inline construction of XML from user data	Use XML serialization libraries; disable external entities (XXE)

Framework	Built-in Protection
React	JSX auto-escapes embedded expressions by default; beware `dangerouslySetInnerHTML`
Angular	Template expressions are auto-sanitized; beware `bypassSecurityTrust*` methods
ASP.NET	Razor views auto-encode output by default; beware `Html.Raw()`
Django	Template engine auto-escapes variables by default; beware `
Spring	Thymeleaf auto-encodes with `th:text`; beware `th:utext` (unescaped)

input-validation

Opciones de instalación

Revisa los archivos de origen