input-validation

Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)

インストールへ移動

リポジトリ: Tyler-R-Kendrick/agent-skills
ソースの最終更新活動: 2026年2月11日 05:14
検出された SKILL.md の言語: 英語
スター: 10
フォーク: 4

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/Tyler-R-Kendrick/agent-skills --skill input-validation

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

14 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

improve

Use when producing agent/LLM evals, synthetic simulation data, or self-improvement pipelines for prompts, code, skills, agents, harnesses, and workflows. Covers AgentEvals/AgentV, Agent Skills evals, ASSERT, GEPA, Trace, VISTA, Agent Lightning, SkillOpt, Simula-style data design, progressive disclosure, deterministic workspaces, and release evidence. USE FOR: eval creation, EVAL.yaml, AgentEvals, AgentV, evals.json, ASSERT, judge-traces, behavior taxonomy, judges, graders, rubrics, synthetic data, simulation data, Simula, QDC, source-grounded generation, prompt optimization, agent improvement, skill improvement, harness hardening, progressive disclosure, deterministic workflows, GEPA, Trace, VISTA, Agent Lightning, SkillOpt DO NOT USE FOR: ordinary unit/integration tests without AI quality criteria (use testing), refactoring without eval or trace feedback (use refactor), generic Agent Skills packaging without eval or improvement work (use agent-skills)

2026-06-09

Use when working with AI agent protocols, standards, interoperability specifications, evaluation contracts, synthetic simulation data, improvement pipelines, and agent steering workflows. Covers MCP, A2A, ACP, Agent Skills, AGENTS.md, ADL, Improve, x402, AP2, MCP Apps, cagent, and learn. USE FOR: agent protocol selection, comparing MCP vs A2A vs ACP, understanding agent standards ecosystem, choosing payment protocols, choosing eval standards, choosing improvement techniques, choosing synthetic data simulation techniques, steering from user feedback DO NOT USE FOR: specific protocol, eval, or improvement implementation details (use the sub-skills: mcp, a2a, acp, improve, learn, x402, etc.)

2026-06-09

learn

Use when a user corrects, rejects, edits, or redirects an LLM/agent response and the correction should become a reusable reasoning strategy. Converts feedback into generalized learnings for ~/.agents/STEERING.md with linked RDF/Turtle evidence. USE FOR: user corrections, preference feedback, rejected agent behavior, reasoning strategy updates, steering file maintenance DO NOT USE FOR: storing task facts (use memory), ordinary skill authoring (use agent-skills), project instruction files unrelated to feedback (use agents-md)

2026-06-08

このリポジトリのすべてを見る

name	input-validation
description	Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)
license	MIT
metadata	{"displayName":"Input Validation & Output Encoding","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Input Validation Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html"},{"title":"OWASP Cross-Site Scripting Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"},{"title":"OWASP SQL Injection Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"}]

Data Type	Validation Rule	Example
Strings	Max length, allowed character set, regex pattern	Username: `^[a-zA-Z0-9_]{3,30}$`
Numbers	Type check, min/max range, integer vs. float	Age: integer, 0-150
Emails	RFC 5322 format validation + DNS MX record check	`user@example.com` — verify domain has MX records
URLs	Scheme allowlist (https only), reject internal/private IPs	Allow `https://` only; block `file://`, `javascript:`, RFC 1918 ranges
File uploads	MIME type check (magic bytes, not extension), max size, rename to random, virus scan	Accept `image/png` up to 5MB; rename to UUID; scan with ClamAV
Dates	Strict format parsing (ISO 8601), valid range check	`2024-01-15` — reject `0000-00-00`, far-future dates

Context	Encoding Method	Example
HTML body	HTML entity encode	`<script>` becomes `<script>`
HTML attributes	HTML attribute encode	`" onclick="alert(1)` becomes `" onclick="alert(1)`
JavaScript	JavaScript encode / `JSON.stringify()`	Embed user data only via `JSON.stringify()` into a variable assignment
URL parameters	URL encode (percent-encoding)	`param=hello world` becomes `param=hello%20world`
CSS	CSS hex encode	`</style>` becomes `\003c\002fstyle\003e`
SQL	Parameterized queries ONLY	Never encode manually for SQL — always use prepared statements

Attack	Root Cause	Prevention
SQL injection	String concatenation in SQL queries	Parameterized queries / prepared statements
XSS (Cross-Site Scripting)	Unencoded user data in HTML output	Context-specific output encoding; Content Security Policy (CSP)
Command injection	String concatenation in shell commands	Avoid shell execution; use language APIs with argument arrays
Path traversal	Unvalidated file paths from user input	Canonicalize paths; validate against an allowed base directory
LDAP injection	Unescaped user input in LDAP queries	LDAP-specific escaping functions; parameterized LDAP queries
XML injection	Inline construction of XML from user data	Use XML serialization libraries; disable external entities (XXE)

Framework	Built-in Protection
React	JSX auto-escapes embedded expressions by default; beware `dangerouslySetInnerHTML`
Angular	Template expressions are auto-sanitized; beware `bypassSecurityTrust*` methods
ASP.NET	Razor views auto-encode output by default; beware `Html.Raw()`
Django	Template engine auto-escapes variables by default; beware `
Spring	Thymeleaf auto-encodes with `th:text`; beware `th:utext` (unescaped)

input-validation

インストール方法

ソースファイルを確認