input-validation

Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)

跳到安装

仓库: Tyler-R-Kendrick/agent-skills
最近来源活动: 2026年2月11日 05:14
检测到的 SKILL.md 语言: 英语
星标: 10
分支: 4

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/Tyler-R-Kendrick/agent-skills --skill input-validation

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

14 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

improve

Use when producing agent/LLM evals, synthetic simulation data, or self-improvement pipelines for prompts, code, skills, agents, harnesses, and workflows. Covers AgentEvals/AgentV, Agent Skills evals, ASSERT, GEPA, Trace, VISTA, Agent Lightning, SkillOpt, Simula-style data design, progressive disclosure, deterministic workspaces, and release evidence. USE FOR: eval creation, EVAL.yaml, AgentEvals, AgentV, evals.json, ASSERT, judge-traces, behavior taxonomy, judges, graders, rubrics, synthetic data, simulation data, Simula, QDC, source-grounded generation, prompt optimization, agent improvement, skill improvement, harness hardening, progressive disclosure, deterministic workflows, GEPA, Trace, VISTA, Agent Lightning, SkillOpt DO NOT USE FOR: ordinary unit/integration tests without AI quality criteria (use testing), refactoring without eval or trace feedback (use refactor), generic Agent Skills packaging without eval or improvement work (use agent-skills)

2026-06-09

Use when working with AI agent protocols, standards, interoperability specifications, evaluation contracts, synthetic simulation data, improvement pipelines, and agent steering workflows. Covers MCP, A2A, ACP, Agent Skills, AGENTS.md, ADL, Improve, x402, AP2, MCP Apps, cagent, and learn. USE FOR: agent protocol selection, comparing MCP vs A2A vs ACP, understanding agent standards ecosystem, choosing payment protocols, choosing eval standards, choosing improvement techniques, choosing synthetic data simulation techniques, steering from user feedback DO NOT USE FOR: specific protocol, eval, or improvement implementation details (use the sub-skills: mcp, a2a, acp, improve, learn, x402, etc.)

2026-06-09

learn

Use when a user corrects, rejects, edits, or redirects an LLM/agent response and the correction should become a reusable reasoning strategy. Converts feedback into generalized learnings for ~/.agents/STEERING.md with linked RDF/Turtle evidence. USE FOR: user corrections, preference feedback, rejected agent behavior, reasoning strategy updates, steering file maintenance DO NOT USE FOR: storing task facts (use memory), ordinary skill authoring (use agent-skills), project instruction files unrelated to feedback (use agents-md)

2026-06-08

查看这个仓库的全部 Skills

name	input-validation
description	Use when implementing input validation and output encoding to prevent injection attacks. Covers validation strategies, context-specific output encoding, parameterized queries, and defense-in-depth approaches across all languages and frameworks. USE FOR: input validation, output encoding, XSS prevention, SQL injection prevention, command injection prevention, parameterized queries, sanitization, allowlisting, content security policy DO NOT USE FOR: authentication validation (use authentication), API rate limiting (use api-security), cryptographic validation (use cryptography)
license	MIT
metadata	{"displayName":"Input Validation & Output Encoding","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Input Validation Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html"},{"title":"OWASP Cross-Site Scripting Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"},{"title":"OWASP SQL Injection Prevention Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"}]

Data Type	Validation Rule	Example
Strings	Max length, allowed character set, regex pattern	Username: `^[a-zA-Z0-9_]{3,30}$`
Numbers	Type check, min/max range, integer vs. float	Age: integer, 0-150
Emails	RFC 5322 format validation + DNS MX record check	`user@example.com` — verify domain has MX records
URLs	Scheme allowlist (https only), reject internal/private IPs	Allow `https://` only; block `file://`, `javascript:`, RFC 1918 ranges
File uploads	MIME type check (magic bytes, not extension), max size, rename to random, virus scan	Accept `image/png` up to 5MB; rename to UUID; scan with ClamAV
Dates	Strict format parsing (ISO 8601), valid range check	`2024-01-15` — reject `0000-00-00`, far-future dates

Context	Encoding Method	Example
HTML body	HTML entity encode	`<script>` becomes `<script>`
HTML attributes	HTML attribute encode	`" onclick="alert(1)` becomes `" onclick="alert(1)`
JavaScript	JavaScript encode / `JSON.stringify()`	Embed user data only via `JSON.stringify()` into a variable assignment
URL parameters	URL encode (percent-encoding)	`param=hello world` becomes `param=hello%20world`
CSS	CSS hex encode	`</style>` becomes `\003c\002fstyle\003e`
SQL	Parameterized queries ONLY	Never encode manually for SQL — always use prepared statements

Attack	Root Cause	Prevention
SQL injection	String concatenation in SQL queries	Parameterized queries / prepared statements
XSS (Cross-Site Scripting)	Unencoded user data in HTML output	Context-specific output encoding; Content Security Policy (CSP)
Command injection	String concatenation in shell commands	Avoid shell execution; use language APIs with argument arrays
Path traversal	Unvalidated file paths from user input	Canonicalize paths; validate against an allowed base directory
LDAP injection	Unescaped user input in LDAP queries	LDAP-specific escaping functions; parameterized LDAP queries
XML injection	Inline construction of XML from user data	Use XML serialization libraries; disable external entities (XXE)

Framework	Built-in Protection
React	JSX auto-escapes embedded expressions by default; beware `dangerouslySetInnerHTML`
Angular	Template expressions are auto-sanitized; beware `bypassSecurityTrust*` methods
ASP.NET	Razor views auto-encode output by default; beware `Html.Raw()`
Django	Template engine auto-escapes variables by default; beware `
Spring	Thymeleaf auto-encodes with `th:text`; beware `th:utext` (unescaped)

input-validation

安装方式

检查来源文件