Agent skill · security · sickn33
infinity
Enforces a strict input boundary protocol (detect, classify, filter, verify) to ensure untrusted data never reaches business logic raw.
Why this skill is useful
Provides a comprehensive input validation protocol that the AI wouldn't reliably generate on its own, ensuring untrusted data is properly filtered before use.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
infinity — Input Boundary & Validation Protocol Core Philosophy Nothing untrusted ever reaches the core — it is stopped before contact. No external data touches the codebase raw. Every boundary where data enters the system must have a filter. The #1 source of silent bugs, crashes, and vulnerabilities is external data that arrives in an unexpected shape and gets used directly without checking. This skill enforces a filter layer at every entry point, every time. --- When to Use This Skill Use when you need to handle an API response Use when reading user input or adding a form handler Use when working with environment variables or CLI arguments Use when parsing webhooks or reading from the filesystem Use when any code calls .body, .params, .query, .env, fs.read, or a third-party SDK response --- The Four Phases PHASE 1 — Boundary Detection Before writing or modifying any code that involves external data, the AI must identify and list every entry point in scope: HTTP request bodies, headers, query params User form inputs and UI-submitted data Environment variables and config files Third-party API responses Webhook payloads File reads from disk CLI arguments Database query results from external sources WebSocket messages The AI must not write any data-handling logic until every entry point in scope is listed. --- PHASE 2 — Classify Each Input For every entry point identified, the AI classifies it into one of three trust levels: Level Definition Examples --- --- --- TRUSTED Internal constants, hardcoded values, your own compile-time config Enum values, hardcoded defaults, internal constants SEMI-TRUSTED Your own internal services, internal APIs, controlled infrastructure Internal microservice responses, your own database reads UNTRUSTED Anything from users, the internet, third parties, or the filesystem User input, external API responses, uploaded files, env vars, CLI args Rule: TRUSTED inputs may be used directly. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/infinity--095d14