Detect SQL injection vulnerabilities via recon, parallel verification, and merged results.
npx skills add https://github.com/utkusen/sast-skills --skill sast-sqli
Please help me install this Agent Skill. Skill: sast-sqli Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-sqli Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-sqli
Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/sqli-results.md. Use when asked to find SQLi or database injection bugs.
Run the sast-sqli skill after completing the sast-analysis step to locate and verify SQL injection sites.
High-intent search queries and answers about installing and using this skill.
The skill detects SQL injection by locating insecure SQL query construction sites via string concat, interpolation, and unsafe ORM methods. It then traces user input to these sites in parallel to verify actual exploitability.
Static analysis targets SQL injection patterns including string concatenation, f-strings, string formatting, unsafe ORM methods, and dynamic identifiers used to construct database queries insecurely.
Run the detection after generating the project's architecture context. The skill applies a three-phase workflow of recon, batched verify in parallel subagents, and merge to output consolidated results to sast/sqli-results.md.
Yes, code security analysis for SQLi requires the sast/architecture.md file. You must run the sast-analysis step first to establish the project's architecture context before verifying vulnerable query construction sites.
The best way to verify taint analysis results is batched parallel verification. The skill groups vulnerable construction sites into batches of three, traces user input in parallel subagents, and merges confirmed findings.
utkusenIdentify and document XML parsing points vulnerable to XXE across a codebase.
utkusenScan codebases for hardcoded secrets and write findings to markdown files.
blacklanternsecurityDiscover web application injection points and test for common vulnerability classes.
Chid0kDetect SQL injection vulnerabilities by analyzing input parameters and response behaviors.
