# Input Validation

Validate and constrain untrusted input at the boundary.

- Repository: https://github.com/Archive228/loopkit (756 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-07-14
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Archive228/loopkit --skill input-validation -g -a claude-code -y`
Codex: `npx skills add Archive228/loopkit --skill input-validation -g -a codex -y`
Cursor: `npx skills add Archive228/loopkit --skill input-validation -g -a cursor -y`
Gemini CLI: `npx skills add Archive228/loopkit --skill input-validation -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Archive228/loopkit`

## Description

Validate and constrain untrusted input at the boundary. Use on any handler that accepts external data.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Input Validation
Validate at the edge, before the data touches logic or storage.
- **Schema**, type, required fields, allowed values. Reject unknown fields rather than ignoring them.
- **Bounds**, string length, number ranges, array size. An unbounded input is a DoS and a memory bomb.
- **Format**, emails, UUIDs, dates parsed and re-validated, not trusted as strings.
- **Files**, size limit, type allowlist (check content, not just extension), no path traversal in names.
- Reject with a clear 4xx and a message that says what's wrong, without leaking internals.
Never trust "it comes from our own frontend". The request can come from anywhere.