Stats
Actions
Tags
Detects SQL injection vulnerabilities by tracing user inputs through code to database queries, flagging unsafe patterns like concatenation and unparameterized ORMs. Scans frameworks including Django, Rails, Express, Go.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sql-injection-detector:detecting-sql-injection-vulnerabilitiesThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Scan application source code for SQL injection vulnerabilities (CWE-89, OWASP A03:2021) by tracing user input from entry points through data flows into database query construction. Detect string concatenation, format string interpolation, and inadequate parameterization across raw SQL, ORM raw query methods, stored procedure calls, and dynamic query builders.
Scan application source code for SQL injection vulnerabilities (CWE-89, OWASP A03:2021) by tracing user input from entry points through data flows into database query construction. Detect string concatenation, format string interpolation, and inadequate parameterization across raw SQL, ORM raw query methods, stored procedure calls, and dynamic query builders.
${CLAUDE_SKILL_DIR}/${CLAUDE_SKILL_DIR}/security-reports/SELECT, INSERT, UPDATE, DELETE, EXEC) and ORM raw query methods (raw(), execute(), createNativeQuery(), $wpdb->query()) across all source files."SELECT * FROM users WHERE id=" + userId`SELECT * FROM users WHERE id=${req.params.id}`Model.objects.raw("SELECT * FROM t WHERE x='" + val + "'")xp_cmdshell or LOAD_FILE()).%s placeholders for Python DB-API, ? for Node.js, $1 for PostgreSQL, named parameters for Spring JPA.${CLAUDE_SKILL_DIR}/security-reports/sqli-scan-YYYYMMDD.md with per-finding severity, CWE-89 mapping, file path and line number, vulnerable code snippet, attack vector demonstration, and remediated code.See ${CLAUDE_SKILL_DIR}/references/implementation.md for the detection pattern library. See ${CLAUDE_SKILL_DIR}/references/critical-findings.md for example vulnerability write-ups with attack demonstrations.
${CLAUDE_SKILL_DIR}/security-reports/sqli-scan-YYYYMMDD.md with all findings classified by severity| Error | Cause | Solution |
|---|---|---|
| Unknown ORM or database framework | Custom or uncommon data access library | Apply generic SQL injection pattern detection; note limited framework-specific guidance |
| Cannot analyze compiled/minified code | Production bundles or bytecode instead of source | Request unminified source; document reduced detection accuracy |
| False positive on sanitized input | Proper sanitization exists but not recognized | Trace sanitization implementation manually; whitelist verified-safe patterns |
| Complex dynamic query builder logic | Multi-step query construction across modules | Trace full data flow manually; flag for manual security review |
| Cannot analyze stored procedure definitions | SQL source files not available in ${CLAUDE_SKILL_DIR}/ | Request .sql files or database schema exports; focus on application-layer code |
${CLAUDE_SKILL_DIR}/references/critical-findings.md -- example vulnerability write-ups with attack vectors${CLAUDE_SKILL_DIR}/references/errors.md -- full error handling reference${CLAUDE_SKILL_DIR}/references/examples.md -- additional usage examplesnpx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin sql-injection-detectorPrevents SQL injection by enforcing parameterized queries and ORM usage over string concatenation. Useful when constructing database queries from user input, API params, or external data.
Detects SQL injection where user input reaches query construction via string concatenation, template literals, or ORM raw methods in JS/TS, Python, Go, Ruby, PHP. For auditing database apps.
Teaches the universal injection pattern across SQL, XSS, command injection, and other interpreters. Useful for code review, secure design, and developer training.