input-validation

Validate and sanitize user-supplied data in JavaScript/TypeScript codebases.

42|9|Updated Mar 16, 2026

Search Tags:#typescript #security #validation #sanitization #injection #csrf

Ready to run

npx skills add https://github.com/drvoss/everything-copilot-cli --skill input-validation-drvoss

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: input-validation
Source: https://github.com/drvoss/everything-copilot-cli/tree/main/skills/security/input-validation
Command: npx skills add https://github.com/drvoss/everything-copilot-cli --skill input-validation-drvoss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Unvalidated user input can lead to injection vulnerabilities such as SQL injection, XSS, and CSRF, compromising application security and data integrity.

Core Features & Use Cases

Surface Mapping: Detects all entry points for user data across routes, request bodies, and file uploads.
Secure Patterns: Provides examples of parameterized queries, output sanitization, and CSRF middleware setup.
Schema Enforcement: Demonstrates runtime validation with libraries like Zod or Joi at API boundaries.
Use Case: Apply this Skill when reviewing or building Express/Node.js services to ensure every external input is safely handled before processing.

Quick Start

Run the input-validation skill to scan your project's source files for missing sanitization and suggest secure patterns.

Frequently Asked Questions about input-validation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate and sanitize user input in an Express API to prevent injection attacks?▼

To validate and sanitize user input in an Express API, enforce runtime schema checks at API boundaries using libraries like Zod or Joi, and use parameterized queries to block injection attacks before data reaches databases or HTML rendering.

What's the best way to secure Node.js request bodies against XSS and CSRF vulnerabilities?▼

Securing Node.js request bodies against XSS and CSRF requires applying output sanitization and configuring CSRF middleware alongside runtime validation to ensure all external inputs are safely handled before processing.

How do I map external entry points for user data in a TypeScript codebase?▼

Mapping external entry points for user data in a TypeScript codebase involves scanning source files to detect all routes, request bodies, and file uploads, identifying where external inputs reach server-side processing for missing sanitization.

Do I need schema enforcement for file uploads in JavaScript server-side code?▼

Yes, schema enforcement is needed for file uploads in JavaScript server-side code because file handling represents an external input surface that requires validation and sanitization to prevent injection vulnerabilities.

Can I use Zod or Joi for runtime validation at API boundaries?▼

Yes, you can use Zod or Joi for runtime validation at API boundaries to enforce schema checks on server-side JavaScript or TypeScript request bodies, ensuring user-supplied data matches expected formats before processing.

Why does unvalidated user input lead to SQL injection and data integrity issues?▼

Unvalidated user input leads to SQL injection and data integrity issues because external data reaches databases or HTML rendering without runtime checks or parameterized queries, allowing malicious payloads to execute as injection attacks.