defense-in-depth

Enforce multi-layer validation across API entry points, business logic, environment guards, and debug instrumentation.

Updated Oct 22, 2025
One-click install
npx skills add https://github.com/franroa/chezmoi --skill defense-in-depth-franroa
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: defense-in-depth
Source: https://github.com/franroa/chezmoi/tree/main/dot_opencode/superpowers/skills/defense-in-depth
Command: npx skills add https://github.com/franroa/chezmoi --skill defense-in-depth-franroa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents bugs caused by invalid data from recurring by mandating validation at every layer data passes through. It ensures that a single fix isn't easily bypassed, making the bug structurally impossible to reintroduce.

Core Features & Use Cases

  • Four Layers of Validation: Guides you to add checks at the entry point, business logic, environment guards, and debug instrumentation layers.
  • Structural Bug Prevention: Ensures that even if one validation layer is bypassed, others will catch the invalid data, making the system more robust.
  • Data Flow Mapping: Requires tracing the data flow and mapping all checkpoints to identify where validation is needed.
  • Use Case: When you fix a bug caused by invalid data (e.g., an empty directory causing a git init failure), use this Skill to add validation at multiple layers. For example, you'd add checks at the API entry point, within the business logic, and as an environment guard for tests, making the bug impossible to reproduce.

Quick Start

Announce skill usage

I'm using the defense-in-depth skill to prevent this bug from recurring.

Example: Entry Point Validation

function createProject(name: string, workingDirectory: string) { if (!workingDirectory || workingDirectory.trim() === '') { throw new Error('workingDirectory cannot be empty'); }

... further checks ...

}

Frequently Asked Questions about defense-in-depth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent bugs caused by invalid data from happening again?

Prevent bugs caused by invalid data by enforcing validation at every layer data passes through—entry points, business logic, environment guards, and debug instrumentation. This makes the bug structurally impossible to reintroduce even if one validation layer is bypassed.

What layers should I add validation checks to?

Add validation checks at four layers: the API entry point to reject invalid input immediately, business logic to enforce domain rules, environment guards for test safety, and debug instrumentation for observable logging. Each layer catches invalid data independently.

How do I map where validation is needed in my data flow?

Trace your data flow end-to-end and identify every checkpoint where invalid data could enter or pass through—API endpoints, function boundaries, environment transitions, and test paths. Mark each checkpoint and add explicit layer-specific checks to ensure no path bypasses validation.

When should I use defense-in-depth validation?

Use defense-in-depth validation when fixing bugs caused by invalid data, such as empty strings or missing required fields. Apply it to prevent the same bug class from recurring across your system by making it impossible for invalid data to propagate undetected.

Why is validating at multiple layers better than a single check?

Multiple validation layers provide redundancy: if one layer is accidentally removed or bypassed, others catch the invalid data. This makes your system robust against future code changes and ensures bugs stay fixed rather than reappearing through different execution paths.

What does deterministic error handling mean in validation?

Deterministic error handling means each validation layer produces consistent, predictable failures with explicit error messages and observable logging. This ensures invalid data is reliably detected and logged across all entry points and test environments, making bugs auditable and testable.