scanning-input-validation-practices
About
This skill automatically scans source code to identify missing or weak input validation, helping prevent vulnerabilities like SQL injection and XSS. It's designed for use during code reviews and security audits to harden applications. The analysis is performed by leveraging a dedicated input-validation-scanner plugin.
Documentation
Overview
This skill automates the process of identifying potential input validation flaws within a codebase. By analyzing how user-provided data is handled, it helps developers proactively address security vulnerabilities before they can be exploited. This skill streamlines security audits and improves the overall security posture of applications.
How It Works
- Initiate Scan: The user requests an input validation scan, triggering the skill.
- Code Analysis: The skill uses the input-validation-scanner plugin to analyze the specified codebase or file.
- Vulnerability Identification: The plugin identifies instances where input validation may be missing or insufficient.
- Report Generation: The skill presents a report highlighting potential vulnerabilities and their locations in the code.
When to Use This Skill
This skill activates when you need to:
- Audit a codebase for input validation vulnerabilities.
- Review newly written code for potential XSS or SQL injection flaws.
- Harden an application against common web security exploits.
- Ensure compliance with security best practices related to input handling.
Examples
Example 1: Identifying XSS Vulnerabilities
User request: "Scan the user profile module for potential XSS vulnerabilities."
The skill will:
- Activate the input-validation-scanner plugin on the specified module.
- Generate a report highlighting areas where user input is directly rendered without proper sanitization, indicating potential XSS vulnerabilities.
Example 2: Checking for SQL Injection Risks
User request: "Check the database access layer for potential SQL injection risks."
The skill will:
- Use the input-validation-scanner plugin to examine the database access code.
- Identify instances where user input is used directly in SQL queries without proper parameterization or escaping, indicating potential SQL injection vulnerabilities.
Best Practices
- Regular Scanning: Integrate input validation scanning into your regular development workflow.
- Contextual Analysis: Always review the identified vulnerabilities in context to determine their actual impact and severity.
- Comprehensive Validation: Ensure that all user-supplied data is validated, including data from forms, APIs, and external sources.
Integration
This skill can be used in conjunction with other security-related skills to provide a more comprehensive security assessment. For example, it can be combined with a static analysis skill to identify other types of vulnerabilities or with a dependency scanning skill to identify vulnerable third-party libraries.
Quick Install
/plugin add https://github.com/jeremylongshore/claude-code-plugins-plus/tree/main/input-validation-scannerCopy and paste this command in Claude Code to install this skill
GitHub 仓库
Related Skills
sglang
MetaSGLang is a high-performance LLM serving framework that specializes in fast, structured generation for JSON, regex, and agentic workflows using its RadixAttention prefix caching. It delivers significantly faster inference, especially for tasks with repeated prefixes, making it ideal for complex, structured outputs and multi-turn conversations. Choose SGLang over alternatives like vLLM when you need constrained decoding or are building applications with extensive prefix sharing.
evaluating-llms-harness
TestingThis Claude Skill runs the lm-evaluation-harness to benchmark LLMs across 60+ standardized academic tasks like MMLU and GSM8K. It's designed for developers to compare model quality, track training progress, or report academic results. The tool supports various backends including HuggingFace and vLLM models.
llamaguard
OtherLlamaGuard is Meta's 7-8B parameter model for moderating LLM inputs and outputs across six safety categories like violence and hate speech. It offers 94-95% accuracy and can be deployed using vLLM, Hugging Face, or Amazon SageMaker. Use this skill to easily integrate content filtering and safety guardrails into your AI applications.
langchain
MetaLangChain is a framework for building LLM applications using agents, chains, and RAG pipelines. It supports multiple LLM providers, offers 500+ integrations, and includes features like tool calling and memory management. Use it for rapid prototyping and deploying production systems like chatbots, autonomous agents, and question-answering services.