Agent skill · software engineering · aaaaqwq
Defense-in-Depth Validation
Validate at every layer data passes through to make bugs impossible
Why this skill is useful
Provides a structured approach to multi-layer validation that the AI wouldn't reliably generate on its own, enhancing data integrity practices.
What it needs
About 2k tokens when loaded. Last updated 2026-08-06. 83 stars on the source repository.
What this skill does
Defense-in-Depth Validation Overview When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks. Core principle: Validate at EVERY layer data passes through. Make the bug structurally impossible. Why Multiple Layers Single validation: "We fixed the bug" Multiple layers: "We made the bug impossible" Different layers catch different cases: Entry validation catches most bugs Business logic catches edge cases Environment guards prevent context-specific dangers Debug logging helps when other layers fail The Four Layers Layer 1: Entry Point Validation Purpose: Reject obviously invalid input at API boundary Layer 2: Business Logic Validation Purpose: Ensure data makes sense for this operation Layer 3: Environment Guards Purpose: Prevent dangerous operations in specific contexts Layer 4: Debug Instrumentation Purpose: Capture context for forensics Applying the Pattern When you find a bug: 1. Trace the data flow - Where does bad value originate? Where used? 2. Map all checkpoints - List every point data passes through 3. Add validation at each layer - Entry, business, environment, debug 4. Test each layer - Try to bypass layer 1, verify layer 2 catches it Example from Session Bug: Empty projectDir caused git init in source code Data flow: 1. Test setup → empty string 2. Project.create(name, '') 3. WorkspaceManager.createWorkspace('') 4. git init runs in process.cwd() Four layers added: Layer 1: Project.create() validates not empty/exists/writable Layer 2: WorkspaceManager validates projectDir not empty Layer 3: WorktreeManager refuses git init outside tmpdir in tests Layer 4: Stack trace logging before git init Result: All 1847 tests passed, bug impossible to reproduce Key Insight All four layers were necessary. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aaaaqwq/sp-defense-in-depth