input-validation-xss-prevention
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides defensive security instructions for sanitizing and validating user-generated content. It demonstrates how to use well-known libraries like Zod to mitigate injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill proactively addresses indirect prompt injection and XSS risks by defining safe ingestion points and implementing sanitization transforms.
- Ingestion points: API route request bodies (
request.json()) and Convex mutation arguments. - Boundary markers: Explicitly mentions that React handles output escaping, providing a secondary defense layer.
- Capability inventory: Documents database write operations (
db.posts.insert,ctx.db.insert) as the primary destination for validated data. - Sanitization: Implements mandatory character replacement (e.g.,
<to empty string) via Zod's.transform()method to neutralize HTML/script injection before data reaches the database. - [EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries including
zodand@clerk/nextjs. These are recognized industry-standard packages and their usage in the provided templates is safe.
Audit Metadata