Data Validation Suite

Claude Code: /plugin marketplace add wshobson/agents → /plugin install data-validation-suite@claude-code-workflows

The plugin is a single agent, and it opens by drawing a boundary: this one writes code while a security auditor assesses posture, so hands-on validation and API hardening belong here and threat modelling and compliance work belongs elsewhere. That framing decides the content. Validation is allowlist-first, queries are parameterised without exception, and output encoding is chosen by context rather than applied uniformly, since escaping for HTML does not protect a JavaScript or URL position. Outbound requests get their own section covering destination allowlisting and SSRF prevention, which is the validation case most often forgotten because the untrusted input is a URL that the server itself will go and fetch.