菜单
Use this skill when fixing a bug caused by invalid data reaching deep into execution. The goal is to add validation at every layer the data passes through, making the bug structurally impossible to reproduce.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when the user has a rough idea, wants to explore a feature, or says "let's brainstorm" or "help me design." The goal is to refine an idea into a validated design doc before any code is written.
Use this skill when ending a session and you want the next session to pick up where you left off. The goal is to capture enough context for seamless session continuity.
Use this skill when starting feature work that needs isolation from the current workspace, or when you need to work on multiple branches simultaneously. The goal is to create an isolated worktree with a verified clean baseline.
Use this skill when documentation has drifted from the codebase, needs an inventory, or should be archived.
Autonomous implementation pipeline. Reads a plan file, reviews it adversarially,
>-
| name | onex-defense-in-depth |
| description | Use this skill when fixing a bug caused by invalid data reaching deep into execution. The goal is to add validation at every layer the data passes through, making the bug structurally impossible to reproduce. |
| disable-model-invocation | true |
Use this skill when fixing a bug caused by invalid data reaching deep into execution. The goal is to add validation at every layer the data passes through, making the bug structurally impossible to reproduce.
A single validation point feels sufficient but can be bypassed by different code paths, refactoring, or mocks. This skill ensures that invalid data is caught at every layer, not just one.
Trace the data flow. Start from where the bad value originates and follow it through every function and module until the failure. List each checkpoint the data passes through.
Add Layer 1: Entry point validation. At the API boundary or public function where data enters, reject obviously invalid input. Check for: empty values, wrong types, missing required fields, and values outside valid ranges.
Add Layer 2: Business logic validation. Inside the core logic that consumes the data, verify it makes sense for the specific operation. This catches cases where entry validation passed but the value is semantically wrong for this context.
Add Layer 3: Environment guards. Add context-specific protections. For example: refuse destructive operations outside temp directories during tests, block production writes in development mode, or reject paths outside the workspace root.
Add Layer 4: Debug instrumentation. Add logging at the point closest to the failure with enough context for forensics: the invalid value, the call stack, and the current environment. This layer catches whatever the other three missed.
Test each layer independently. Write tests that bypass Layer 1 and verify Layer 2 catches the bad data. Write tests that bypass both and verify Layer 3 catches it. Confirm Layer 4 logs the right context.
For each bug fix:
