Why does this skill emphasize allowlists instead of blocklists?

Allowlists are inherently more secure because they explicitly define what is permitted, whereas blocklists are prone to missing new or creative attack vectors.

Is client-side validation covered by this skill?

While it acknowledges client-side validation for UX, the skill prioritizes server-side validation as the only reliable security layer for protecting your application.

Does this skill support both TypeScript and Python?

Yes, it provides production-ready patterns and best practices for Zod v4 in TypeScript and Pydantic in Python.

Can this skill help with file upload security?

Yes, it includes patterns for validating file magic bytes and size limits rather than relying on easily spoofed file extensions or headers.

Input Validation & Sanitization

Name: Input Validation & Sanitization
Author: yonatangross

byyonatangross

•

Security & Testing

Implements secure input validation and sanitization patterns using Zod and Pydantic to prevent injection attacks and ensure data integrity.

About

This skill provides a comprehensive framework for Claude to handle untrusted user input securely across TypeScript and Python environments. It emphasizes a 'security-first' approach by focusing on server-side validation using Zod v4 and Pydantic. By implementing allowlist strategies, type coercion, and schema-driven development, it helps developers mitigate common security vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and malformed API requests, ensuring that application data remains clean and predictable.

Key Features

Schema-driven validation using Zod v4 and Pydantic models
Secure file upload validation including magic byte checking
29 GitHub stars
Automatic type coercion for query parameters and form data
Implementation of robust allowlist strategies over brittle blocklists
Support for discriminated unions in complex data structures

Use Cases

Securing FastAPI or Express.js API endpoints against malformed request bodies
Implementing secure file upload handlers that verify actual content types
Validating complex form submissions and URL query parameters in web applications

About

Key Features

Schema-driven validation using Zod v4 and Pydantic models
Secure file upload validation including magic byte checking
29 GitHub stars
Automatic type coercion for query parameters and form data
Implementation of robust allowlist strategies over brittle blocklists
Support for discriminated unions in complex data structures

Use Cases

Securing FastAPI or Express.js API endpoints against malformed request bodies
Implementing secure file upload handlers that verify actual content types
Validating complex form submissions and URL query parameters in web applications