log-injection-anti-pattern

What problem does it solve?

This Skill prevents attackers from injecting malicious or misleading entries into your application logs by exploiting unsanitized user input, which can hide malicious activity or cause system misinterpretation.

Core Features & Use Cases

• Detects unsanitized input in log messages: Identifies vulnerabilities where user-provided data is directly written to logs.
• Provides secure logging practices: Demonstrates how to sanitize input or use structured logging to prevent injection.
• Use Case: When reviewing code that handles user-submitted comments or system event data, this skill helps ensure that malicious strings like "\nINFO - System compromised" cannot be added to the logs.

Quick Start

Review the current code for any instances where user input is logged without proper sanitization.