injection

Analyze source code for injection vulnerabilities and generate parameterized fixes.

12|1|Updated Feb 9, 2026

Search Tags:#security #vulnerability #sql injection #injection #command injection #code scanning

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: injection
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/injection
Command: npx skills add https://github.com/florianbuetow/claude-code --skill injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and helps remediate injection vulnerabilities in your codebase, protecting against common security threats like SQL injection and command injection.

Core Features & Use Cases

Vulnerability Detection: Scans code for various injection patterns including SQL, NoSQL, OS command, LDAP, and expression language injection.
Severity Assessment: Assigns severity levels (critical, high, medium) to identified vulnerabilities.
Fix Suggestions: Provides concrete refactoring suggestions and parameterized replacements for vulnerable code.
Use Case: A developer can use this Skill to audit a new API endpoint for potential SQL injection flaws before deployment, ensuring data integrity and preventing unauthorized access.

Quick Start

Use the injection skill to scan the current directory for all injection vulnerabilities and suggest fixes.

Frequently Asked Questions about injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan source code for SQL injection vulnerabilities?▼

Scanning source code for SQL injection vulnerabilities involves analyzing code patterns and tracing data flow to identify untrusted inputs. The tool maps findings to OWASP A03:2021, assesses severity, and generates parameterized replacement fixes.

What types of injection vulnerabilities are covered by OWASP A03:2021?▼

OWASP A03:2021 encompasses SQL, NoSQL, OS command, LDAP, and expression language injection. Scanning tools detect these patterns by tracing data flow from untrusted sources to execution sinks and assigning severity ratings.

How do I fix command injection vulnerabilities in my code?▼

Fix command injection vulnerabilities by applying the concrete refactoring suggestions and parameterized replacements generated after the code scan. This neutralizes malicious inputs by separating untrusted data from executable commands.

Can I audit a new API endpoint for injection flaws before deployment?▼

Yes, you can audit a new API endpoint for injection flaws by scanning the source code directory before deployment. This identifies potential SQL and command injection threats early, ensuring data integrity and preventing unauthorized access.

How does data-flow tracing detect NoSQL and LDAP injection patterns?▼

Data-flow tracing detects NoSQL and LDAP injection by tracking how untrusted user input traverses application logic to reach execution sinks. It analyzes source code to map these flows against OWASP A03:2021 patterns and assesses severity.