\r \r

InputShield -- Input Validation & Sanitization Scanner\r

\r InputShield scans codebases for missing input validation, unsafe deserialization, ReDoS (Regular Expression Denial of Service), path traversal, command injection, XSS via unsanitized output, and other input handling vulnerabilities. It uses regex-based pattern matching against 90 vulnerability patterns across 6 detection categories, produces markdown reports with actionable remediation recommendations, and integrates with git hooks via lefthook. 100% local. Zero telemetry.\r \r

Commands\r

\r

Free Tier (No license required)\r

\r

inputshield scan [file|directory]\r

One-shot input validation scan of files or directories.\r \r How to execute:\r

bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target]\r
```\r
\r
**What it does:**\r
1. Accepts a file path or directory (defaults to current directory)\r
2. Discovers all source files (skips .git, node_modules, binaries, images, .min.js)\r
3. Runs 90 input validation vulnerability detection patterns against each file\r
4. Respects .gitignore and exclusion files\r
5. Calculates an input safety score (0-100) per file and overall\r
6. Grades: A (90-100), B (80-89), C (70-79), D (60-69), F (\x3C60)\r
7. Outputs findings with: file, line number, check ID, severity, description, recommendation\r
8. Exit code 0 if score >= 70, exit code 1 if score \x3C 70\r
9. Free tier limited to first 30 patterns (5 per category)\r
\r
**Example usage scenarios:**\r
- "Scan my code for input validation issues" -> runs `inputshield scan .`\r
- "Check for XSS vulnerabilities" -> runs `inputshield scan src/`\r
- "Find command injection risks" -> runs `inputshield scan .`\r
- "Audit input handling in my project" -> runs `inputshield scan .`\r
- "Check for ReDoS patterns" -> runs `inputshield scan .`\r
- "Find path traversal vulnerabilities" -> runs `inputshield scan src/`\r
\r
### Pro Tier ($19/user/month -- requires INPUTSHIELD_LICENSE_KEY)\r
\r
#### `inputshield scan --tier pro [file|directory]`\r
Full scan with 60 patterns (10 per category).\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target] --tier pro --license-key "$INPUTSHIELD_LICENSE_KEY"\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Runs expanded pattern set (60 of 90 patterns)\r
3. All free tier features plus deeper detection coverage\r
4. Unlimited file scanning\r
\r
#### `inputshield hooks install`\r
Install git pre-commit hooks that scan staged files for input validation issues before every commit.\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" hooks install\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Copies lefthook config to project root\r
3. Installs lefthook pre-commit hook\r
4. On every commit: scans all staged files, blocks commit if critical/high findings\r
\r
#### `inputshield hooks uninstall`\r
Remove InputShield git hooks.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" hooks uninstall\r
```\r
\r
#### `inputshield report [directory]`\r
Generate a markdown input validation report with findings, severity breakdown, and remediation steps.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" report --path [directory]\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Runs full scan of the directory\r
3. Generates a formatted markdown report from template\r
4. Includes per-file breakdowns, input safety scores, remediation priority\r
5. Output suitable for security reviews and compliance audits\r
\r
### Team/Enterprise Tier ($39/user/month -- requires INPUTSHIELD_LICENSE_KEY with team tier)\r
\r
#### `inputshield scan --tier team [file|directory]`\r
Complete scan with all 90 patterns (15 per category).\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target] --tier team --license-key "$INPUTSHIELD_LICENSE_KEY"\r
```\r
\r
#### `inputshield audit [directory]`\r
Deep input validation audit with all 90 patterns and verbose output.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" audit --path [directory] --verbose\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Runs all 90 patterns with verbose output\r
3. Per-category breakdown with detailed statistics\r
4. JSON/HTML output formats available\r
\r
#### `inputshield scan --category [IV|DS|RD|PT|CI|XS]`\r
Category-specific scan to focus on a single vulnerability class.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target] --category CI\r
```\r
\r
#### `inputshield status`\r
Show license and configuration information.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" status\r
```\r
\r
## Detection Categories\r
\r
InputShield detects 90 vulnerability patterns across 6 categories (15 patterns each):\r
\r
| Category | Code | Examples | Severities |\r
|----------|------|----------|------------|\r
| **Input Validation** | IV | Missing length checks, no type validation, raw user input acceptance, missing allowlist, no boundary checks, unvalidated numeric input, missing null checks, regex-less format validation | Critical/High/Medium/Low |\r
| **Deserialization** | DS | Unsafe JSON.parse, pickle.loads, yaml.load without SafeLoader, Java ObjectInputStream, unvalidated unmarshaling, PHP unserialize, Ruby Marshal.load, .NET BinaryFormatter | Critical/High/Medium |\r
| **ReDoS** | RD | Catastrophic backtracking, nested quantifiers, overlapping alternations, exponential patterns, unbounded repetition on complex groups, evil regex constructs | High/Medium/Low |\r
| **Path Traversal** | PT | Directory traversal (../), unsanitized file paths, user-controlled file access, symlink following, path joining with user input, open() with variables, file inclusion | Critical/High/Medium |\r
| **Command Injection** | CI | Shell exec with user input, eval(), exec(), system() with variables, subprocess with shell=True, os.popen, template injection, child_process.exec | Critical/High/Medium |\r
| **XSS/Output** | XS | innerHTML with user data, dangerouslySetInnerHTML, document.write, unsanitized template interpolation, missing output encoding, v-html directive, raw HTML rendering | Critical/High/Medium/Low |\r
\r
## Severity Levels\r
\r
| Level | Meaning | Score Weight | Action Required |\r
|-------|---------|-------------|-----------------|\r
| **Critical** | Directly exploitable vulnerabilities (RCE, injection) | -25 points | Fix immediately -- blocks deployment |\r
| **High** | Serious security risks requiring prompt attention | -15 points | Fix in current sprint |\r
| **Medium** | Potential vulnerabilities that need review | -8 points | Review and remediate |\r
| **Low** | Informational, possible false positives, style issues | -3 points | Investigate when convenient |\r
\r
## Scoring System\r
\r
InputShield calculates an **Input Safety Score** from 0 to 100:\r
\r
- Score starts at **100** (clean)\r
- Each finding deducts points based on severity: critical=25, high=15, medium=8, low=3\r
- Score floors at **0** (cannot go negative)\r
- **Pass threshold: 70** (exit code 0 if >= 70, exit code 1 if \x3C 70)\r
\r
### Letter Grades\r
\r
| Grade | Score Range | Meaning |\r
|-------|------------|---------|\r
| **A** | 90-100 | Excellent -- minimal or no input validation issues |\r
| **B** | 80-89 | Good -- minor issues that should be addressed |\r
| **C** | 70-79 | Acceptable -- passing threshold, issues need attention |\r
| **D** | 60-69 | Poor -- below threshold, significant issues found |\r
| **F** | 0-59 | Failing -- critical input validation vulnerabilities detected |\r
\r
## Tier-Based Pattern Access\r
\r
| Tier | Patterns Available | Per Category | Price |\r
|------|-------------------|-------------|-------|\r
| **Free** | 30 patterns | 5 per category | $0 |\r
| **Pro** | 60 patterns | 10 per category | $19/user/month |\r
| **Team** | 90 patterns (all) | 15 per category | $39/user/month |\r
| **Enterprise** | 90 patterns (all) | 15 per category | Custom pricing |\r
\r
## Configuration\r
\r
Users can configure InputShield in `~/.openclaw/openclaw.json`:\r
\r
```json\r
{\r
  "skills": {\r
    "entries": {\r
      "inputshield": {\r
        "enabled": true,\r
        "apiKey": "YOUR_LICENSE_KEY_HERE",\r
        "config": {\r
          "severityThreshold": "high",\r
          "ignorePatterns": ["**/test/**", "**/fixtures/**", "**/*.test.*"],\r
          "ignoreChecks": [],\r
          "reportFormat": "markdown",\r
          "categories": ["IV", "DS", "RD", "PT", "CI", "XS"]\r
        }\r
      }\r
    }\r
  }\r
}\r
```\r
\r
## Output Formats\r
\r
InputShield supports three output formats via `--format`:\r
\r
- **text** (default) -- Colorized terminal output with severity badges\r
- **json** -- Structured JSON output for CI/CD integration\r
- **html** -- HTML report with severity highlighting and category charts\r
\r
## Important Notes\r
\r
- **Free tier** works immediately with no configuration (30 patterns, 5 per category)\r
- **All scanning happens locally** -- no code is sent to external servers\r
- **License validation is offline** -- no phone-home or network calls\r
- Pattern matching only -- no AST parsing, no external dependencies beyond bash\r
- Supports scanning all file types in a single pass\r
- Git hooks use **lefthook** which must be installed (see install metadata above)\r
- Exit codes: 0 = pass (score >= 70), 1 = fail (score \x3C 70, for CI/CD integration)\r
- All regex patterns use POSIX ERE syntax compatible with `grep -E`\r
\r
## Error Handling\r
\r
- If lefthook is not installed and user tries `hooks install`, prompt to install it\r
- If license key is invalid or expired, show clear message with link to https://inputshield.pages.dev/renew\r
- If a file is binary, skip it automatically with no warning\r
- If no scannable files found in target, report clean scan with info message\r
- If --category specifies an invalid category, show available categories\r
\r
## When to Use InputShield\r
\r
The user might say things like:\r
- "Scan my code for input validation issues"\r
- "Check for XSS vulnerabilities"\r
- "Find command injection risks in my project"\r
- "Audit input handling"\r
- "Check for ReDoS patterns"\r
- "Find path traversal vulnerabilities"\r
- "Scan for unsafe deserialization"\r
- "Check if my code sanitizes user input"\r
- "Find missing input validation"\r
- "Detect SQL injection and command injection"\r
- "Check for unsafe eval usage"\r
- "Scan for innerHTML XSS risks"\r
- "Find pickle.loads and yaml.load issues"\r
- "Generate an input validation report"\r
- "Set up pre-commit hooks for input validation"\r
- "Run a security scan focused on input handling"\r