log-injection-detector
Log injection detector: harvests every console.log/logger.info/log.Error/etc call, classifies arguments for attacker-controlled input (CWE-117), CRLF injection surface, sensitive data leakage (passwords, tokens, secrets). LLM validates each finding as injectable and proposes sanitization (parameterized logging, newline stripping, sensitive-field redaction). Read-only. Audience: Senior. Trigger: /log-injection
Pinned to revision 29d23a8cf80e, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/log-injection-detector/SKILL.md
- skills/log-injection-detector/README.md
- skills/log-injection-detector/scripts/log-arg-scan.ps1
Every link opens the file at its source, pinned to the revision this page describes.