defense-in-depth

Validate data flow at entry point, business logic, environment guards, and debug instrumentation.

270k|24.1k|Updated Oct 9, 2025
One-click install
npx skills add https://github.com/obra/superpowers --skill defense-in-depth-obra
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: defense-in-depth
Source: https://github.com/obra/superpowers/tree/main/skills/defense-in-depth
Command: npx skills add https://github.com/obra/superpowers --skill defense-in-depth-obra

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solves? This Skill prevents the recurrence of bugs caused by invalid data by mandating validation at every layer data passes through. It makes bugs structurally impossible rather than relying on a single, potentially bypassable check, ensuring robust system integrity.

Core Features & Use Cases

  • Four Layers of Validation: Guides implementation of checks at entry point, business logic, environment guards, and debug instrumentation, creating a comprehensive defense.
  • Structural Bug Prevention: Ensures that even if one validation layer is bypassed, subsequent layers will catch the invalid data, preventing issues from propagating.
  • Context-Specific Guards: Recommends environment-specific checks (e.g., refusing git init outside temp directories in tests) to prevent dangerous operations in specific contexts.
  • Use Case: After fixing a bug where an empty projectDir caused git init in the source code, this skill ensures you add validation not just at the Project.create() call, but also in WorkspaceManager, WorktreeManager (with environment guards), and debug logging, making the bug impossible to reintroduce.

Quick Start

Example: Validating workingDirectory for project creation

Layer 1: Entry Point Validation (API boundary)

function createProject(name: string, workingDirectory: string) { if (!workingDirectory || workingDirectory.trim() === '') { throw new Error('workingDirectory cannot be empty'); } if (!existsSync(workingDirectory)) { throw new Error(workingDirectory does not exist: ${workingDirectory}); } // ... more checks ... }

Layer 2: Business Logic Validation (operation-specific)

function initializeWorkspace(projectDir: string, sessionId: string) { if (!projectDir) { throw new Error('projectDir required for workspace initialization'); } // ... }

Layer 3: Environment Guards (context-specific dangers)

async function gitInit(directory: string) { if (process.env.NODE_ENV === 'test') { // Refuse git init outside temp dir during tests const normalized = normalize(resolve(directory)); const tmpDir = normalize(resolve(tmpdir())); if (!normalized.startsWith(tmpDir)) { throw new Error(Refusing git init outside temp dir during tests: ${directory}); } } // ... }

Layer 4: Debug Instrumentation (forensics)

async function gitInit(directory: string) { const stack = new Error().stack; logger.debug('About to git init', { directory, cwd: process.cwd(), stack }); // ... }

Frequently Asked Questions about defense-in-depth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent bugs caused by invalid data in my application?

Validate data at every layer it passes through—entry point, business logic, environment guards, and debug instrumentation. Multi-layer validation makes bugs structurally impossible because even if one check is bypassed, subsequent layers catch invalid data before it propagates.

What's the best way to implement defensive programming across multiple code layers?

Apply validation at entry points (API boundaries), business logic operations, environment-specific guards (e.g., refusing dangerous operations in test contexts), and debug logging with stack traces. This defense-in-depth approach ensures data integrity across all code paths.

How do I add validation to prevent a specific bug from happening again?

Add checks not just where the bug surfaced, but at every layer the affected data flows through. Include entry-point validation, operation-specific checks, context guards for dangerous operations, and debug instrumentation to trace data movement across your system.

Can I use environment-specific validation to prevent operations in certain contexts?

Yes. Environment guards let you refuse risky operations during specific conditions—for example, blocking `git init` outside temporary directories during tests. This context-aware validation prevents dangerous actions in vulnerable environments.

What happens if I only validate data at one point in my code?

Single-point validation is bypassable and leaves your system vulnerable. Data can reach that validation from other code paths, and if the check is circumvented, invalid data propagates uncaught. Multi-layer validation closes these gaps.

How do I use debug instrumentation to catch data flow issues?

Log data state, current working directory, and stack traces before critical operations. This forensic layer doesn't prevent bugs but captures evidence of how invalid data reached that point, enabling faster diagnosis and prevention of recurrence.