Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-sql-injection-patterns
Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements.
Passed 17 of 21 test cases with the skill, and 14 of 21 without it.
and 1 more in the full report
3 fixed15 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to generate a Markdown format report for a SQL injection scan on `/src/api` and output it to `/tmp/sqli-report.md`. What options should be supplied to the scanner script?
| Checked | Without skill | With skill |
|---|---|---|
| Passes --format markdown to the scanner script. | Missed | Passed |
| Passes --output /tmp/sqli-report.md to the scanner script. | Missed | Passed |
The instructions your model reads when the skill loads.
SQL injection (CWE-89, OWASP A03:2021) remains one of the highest- impact and most-easily-introduced vulnerability classes. The fix is near-universal: use parameterized queries. The cause when introduced: an engineer concatenates user input into a SQL string because the ORM's parameterization mechanism wasn't obvious, or because they "just need to add a quick condition."
The scanner reads source files and grades each apparent SQL-string construction against the threshold table.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
| f-string with SQL keywords + user input | CRITICAL | f"SELECT * FROM users WHERE id = {user_id}" | CWE-89 |
| String concat into SQL keyword string | CRITICAL | "SELECT ... " + var + " ..." | CWE-89 |
| %-format SQL string | HIGH | "SELECT * FROM %s" % table_name | CWE-89 |
.format() into SQL string | HIGH | "SELECT {} FROM users".format(col) | CWE-89 |
cursor.execute(f"...") | CRITICAL | f-string passed directly to cursor.execute | CWE-89 |
sequelize.query with template literal | HIGH | sequelize.query(\SELECT * FROM ${table}`)` | CWE-89 |
| Knex / sequelize raw() with interpolation | HIGH | knex.raw('SELECT * FROM ' + table) | CWE-89 |
Django .extra() with raw SQL | MEDIUM | Model.objects.extra(where=['col = ' + val]) | CWE-89 |
cursor.executemany with string-built query | CRITICAL | Same risk as execute | CWE-89 |
JDBC Statement.execute with concat | HIGH | Java pattern: not PreparedStatement | CWE-89 |
Rails where() with string interpolation | HIGH | User.where("name = '#{name}'") | CWE-89 |
Go db.Query with fmt.Sprintf | HIGH | db.Query(fmt.Sprintf("...", arg)) | CWE-89 |
test cases passed, vs 14 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.