Input Validation Scanner
Overview
Scan application source code for missing or insufficient input validation that could lead to injection attacks (SQL, XSS, command injection), buffer overflows, and path traversal vulnerabilities. Analyzes how user-provided data flows from HTTP parameters, form fields, and API inputs through the application to identify locations where sanitization or validation is absent.
How It Works
- Initiate Scan: The user requests an input validation scan, triggering the skill.
- Code Analysis: The skill uses the input-validation-scanner plugin to analyze the specified codebase or file.
- Vulnerability Identification: The plugin identifies instances where input validation may be missing or insufficient.
- Report Generation: The skill presents a report highlighting potential vulnerabilities and their locations in the code.
When to Use This Skill
This skill activates when you need to:
- Audit a codebase for input validation vulnerabilities.
- Review newly written code for potential XSS or SQL injection flaws.
- Harden an application against common web security exploits.
- Ensure compliance with security best practices related to input handling.
Examples
Example 1: Identifying XSS Vulnerabilities
User request: "Scan the user profile module for potential XSS vulnerabilities."
The skill will:
- Activate the input-validation-scanner plugin on the specified module.
- Generate a report highlighting areas where user input is directly rendered without proper sanitization, indicating potential XSS vulnerabilities.
Example 2: Checking for SQL Injection Risks
User request: "Check the database access layer for potential SQL injection risks."
