sc-sqli

Trace SQL injection vulnerabilities from sources to sinks across multiple languages.

56|5|Updated Apr 8, 2026
One-click install
npx skills add https://github.com/ersinkoc/security-check --skill sc-sqli
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: sc-sqli
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-sqli
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-sqli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SQL injection vulnerabilities across application code paths by tracing user input through data flows to database queries and highlighting unsafe patterns.

Core Features & Use Cases

  • Cross-language detection across Go, TypeScript/JavaScript, Python, PHP, Java, and ORM layers.
  • Data-flow analysis from sources (e.g., HTTP request parameters) to sinks (e.g., database queries).
  • Remediation guidance with concrete patterns to fix risky query constructions.

Quick Start

Scan your codebase to identify SQL injection patterns and generate a risk report.

Frequently Asked Questions about sc-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect SQL injection vulnerabilities across multiple programming languages?

SQL injection detection scans Go, TypeScript/JavaScript, Python, PHP, and Java codebases to identify unsafe string concatenation and raw query usage. It traces data flows from HTTP request sources to database sinks, generating actionable remediation guidance.

Can I trace SQL injection risks through ORM data access layers?

Yes, SQL injection analysis supports ORM-based data access layers in web applications. It traces user input through data flow paths to detect risky template interpolation and raw query usage within ORM constructs during security assessments or CI workflows.

What is data flow analysis for SQL injection and how does it identify unsafe query construction?

Data flow analysis for SQL injection traces user input from sources like HTTP request parameters down to database query sinks. It highlights unsafe patterns including string concatenation, template interpolation, and raw query usage to pinpoint vulnerable code paths.

How do I integrate SQL injection scanning into CI workflows for web applications?

You can integrate SQL injection scanning into CI workflows by running it against your application codebase. It performs static analysis to identify vulnerable data paths and outputs a risk report with concrete patterns to fix risky query constructions.

Does static analysis for SQL injection provide remediation guidance for detected vulnerabilities?

Static analysis for SQL injection provides actionable remediation guidance with concrete patterns to fix risky query constructions. It identifies unsafe string concatenation and template interpolation, offering specific solutions to secure the traced code paths.