vm-input-validation-checker

# Input Validation Checker Skill

Identifies injection vulnerabilities and validates input sanitization and output encoding practices.

## Brownfield Context

This skill is designed for **static analysis of existing code** — it does not require tests or a greenfield baseline. It traces user-controlled data from entry points (HTTP parameters, headers, body fields, file uploads) through the code to identify points where that data reaches a dangerous sink (SQL query, shell command, HTML output, LDAP query, etc.) without adequate sanitization. Particularly important in brownfield codebases where input handling may have been added incrementally and inconsistently.

## When to Use This Skill

- Scanning existing code for SQL injection patterns
- Detecting XSS risks in server-rendered or client-side rendered output
- Identifying command injection in brownfield scripts or legacy handlers
- Checking for LDAP, XML, NoSQL injection in enterprise integrations
- Validating input sanitization completeness in existing API layers
- Reviewing output encoding practices in template rendering code

## Unitary Function

**ONE RESPONSIBILITY:** Detect injection vulnerabilities and validate input/output handling

**NOT RESPONSIBLE FOR:**
- Authentication review (see vm-auth-auditor)
- Encryption review (see vm-data-protection-reviewer)
- API-specific security beyond injection (see vm-api-security-reviewer)
- General vulnerability scanning (see vm-vulnerability-scanner)
- Fixing injection flaws (read-only skill)

## Input

```json
{
  "source_path": "Path to source code directory",
  "scope": "full|file_list",
  "files": ["optional explicit file list for change-scoped review"],
  "injection_types": ["sql", "xss", "command", "ldap", "xml", "nosql", "path_traversal", "template"],
  "severity_threshold": "critical|high|medium|low"
}
```

## Output

```json
{
  "audit_id": "uuid",
  "generated_by": {
    "skill": "vm-input-validation-checker",
    "version": "1.0.0"
  },
  "timestamp": "ISO-8601",
  "source_path": "string",
  "risk_score": "Critical|High|Medium|Low",
  "findings": {
    "sql_injection": [
      {
        "severity": "Critical",
        "issue": "Unsanitized user input in SQL query via string formatting",
        "location": "api/users.py:34",
        "code": "query = f\"SELECT * FROM users WHERE id={user_id}\"",
        "remediation": "Use parameterized queries or ORM — e.g., session.query(User).filter(User.id == user_id)"
      }
    ],
    "xss": [],
    "command_injection": [],
    "ldap_injection": [],
    "xml_injection": [],
    "nosql_injection": [],
    "path_traversal": [],
    "template_injection": [],
    "input_sanitization_gaps": [],
    "output_encoding_gaps": []
  },
  "recommendations": []
}
```

## Injection Types Detected

- **SQL Injection**: String concatenation, f-string formatting, dynamic query construction, ORM raw() misuse
- **XSS**: Reflected (HTTP input → response), stored (DB → rendered output), DOM-based (client-side sinks)
-