# Sec Input Validation Generator

> Generate strict input validation, type-checking, and sanitization code using modern libraries to address Injection (A05:2025) and Integrity Failures (A08:2025).

- Skill: `jcorpac/sec-input-validation-generator` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jcorpac/sec-input-validation-generator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jcorpac/sec-input-validation-generator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jcorpac (https://skillmd.com/u/jcorpac)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jcorpac/sec-input-validation-generator

---


# Input Validation Generator

This skill focuses on a critical remediation strategy: strict input validation. It is designed to mitigate vulnerabilities like **A05:2025 – Injection** and **A08:2025 – Software or Data Integrity Failures** by ensuring that all data crossing trust boundaries is rigorously checked.

## Usage

Use this skill to refactor existing vulnerable code or correctly construct new data ingestion points using robust validation libraries.

**Example Triggers:**
* "I have an Express route that takes a JSON body. Can you rewrite it using Zod to validate the input strictly?"
* "Help me secure this Python FastAPI endpoint against injection using Pydantic models."
* "What is the best way to sanitize this HTML input before storing it in the database?"

## Workflow

1.  **Analyze the Data Contract:** Understand what data the endpoint or function expects (types, formats, lengths, constraints).
2.  **Select the Framework-Appropriate Library:**
    *   TypeScript/JavaScript: **Zod**, Yup, or Joi.
    *   Python: **Pydantic** or Marshmallow.
    *   Go: `validator` packages alongside strict unmarshaling.
3.  **Generate Validation Schemas:**
    *   Implement **allow-listing** (defining exactly what *is* allowed) rather than block-listing (trying to guess what is bad).
    *   Enforce strict type checking.
    *   Apply boundaries: minimum/maximum lengths for strings, ranges for numbers.
    *   Use regex for specific formats (e.g., emails, UUIDs).
4.  **Sanitization vs. Validation:** Clarify that validation (rejecting bad data) is preferred over sanitization (trying to clean bad data). However, if sanitization is required (e.g., accepting rich text HTML), provide code using established, maintained HTML sanitization libraries (like `DOMPurify`) rather than custom regex stripping.

## Output Expectation

The generated code should demonstrate how to parse the incoming request, validate it against the schema, cleanly handle validation errors (returning 400 Bad Request), and use the typed, validated data in the subsequent application logic.