Validate and Filter All External Input at System Boundaries

Infinity enforces one core rule: nothing untrusted ever reaches the core of an application - it is stopped before contact. It works through four phases in strict order: first listing every entry point in scope (HTTP bodies/headers/query params, form inputs, env vars, third-party API responses, webhook payloads, file reads, CLI args, WebSocket messages) before writing any handling code at all; then classifying each one as TRUSTED (internal constants, hardcoded config), SEMI-TRUSTED (internal services, your own database reads), or UNTRUSTED (anything from users, the internet, third parties, or the filesystem); then writing a mandatory filter layer for every SEMI-TRUSTED/UNTRUSTED input; and finally tracing every entry point to confirm a filter genuinely exists before declaring the work done.

Use it when handling an API response, reading user input or a form submission, working with environment variables or CLI arguments, parsing a webhook, reading from the filesystem, or writing any code that touches .body, .params, .query, .env, fs.read, or a third-party SDK response. It explicitly does not apply to purely internal logic with no external data involved, and the skill itself notes it may add unwarranted verbosity to trivial scripts where strict validation isn't actually needed.

Phases 1, 2, and 4 produce no code, only structured output: a "BOUNDARY MAP" table classifying each entry point's trust level and whether a filter is required, and a later "VERIFICATION" table confirming a filter exists for each one, explicitly stating "Unfiltered inputs reaching logic: NONE" or flagging any gap. Phase 3 is where code gets written, covering type checking (never assume a string is a string), schema validation (reject on a missing required field rather than falling back silently), sanitization before rendering to prevent XSS, and presence/format checks for env vars, IDs, and tokens. Its hard rules are absolute: no raw external data in business logic ever, no silent fallbacks on bad input, no assuming shape even when an API "always" returns the same thing, missing env vars must fail loudly at startup rather than silently at runtime, and a filter that only checks presence but not format doesn't count as filtered.

INFINITY - BOUNDARY MAP
req.body.email      | UNTRUSTED |  format + sanitize
PAGINATION_LIMIT=20 | TRUSTED   |  none needed

It is a process discipline rather than a library dependency, applying wherever code reads req.body/req.params/req.query, process.env, filesystem reads, webhook payloads, or third-party API/SDK responses, regardless of language or framework.

Developers writing any code that touches external input - API handlers, form processing, webhook receivers, CLI tools, or file readers - who want a systematic way to prevent the class of bugs the skill names explicitly: SQL injection from unvalidated params, crashes from unexpected API response shapes, XSS from unescaped content, and silent failures from missing environment variables discovered only at runtime.