Detect unsafe SQL query construction from source code patterns.
npx skills add https://github.com/pruiz/CodeCome --skill sql-injection-pruiz
Please help me install this Agent Skill. Skill: sql-injection Source: https://github.com/pruiz/CodeCome/tree/main/.opencode/skills/sql-injection Command: npx skills add https://github.com/pruiz/CodeCome --skill sql-injection-pruiz
This Skill helps developers and security professionals detect unsafe SQL query construction that could be exploited by attackers to manipulate database operations.
Use the sql-injection skill to analyze your project's source code for potential insecure SQL query patterns.
High-intent search queries and answers about installing and using this skill.
To detect SQL injection vulnerabilities, this Skill scans source code for unsafe query construction patterns like dynamic string concatenation and unparameterized inputs. It identifies areas where user input reaches raw SQL execution points without proper parameterization to reduce security risks.
Common unsafe SQL query construction patterns include direct string concatenation, unvalidated identifiers, and the improper use of ORM or query builders. These practices allow unparameterized user input to manipulate database operations and create injection vulnerabilities.
Yes, you can scan for SQL injection across multiple programming languages and frameworks. The analysis identifies code areas interacting with SQL databases and flags improper ORM or query builder usage regardless of the specific implementation language.
To audit a web application for unparameterized database inputs, analyze your source code to pinpoint places where user input reaches raw SQL execution points. This process highlights direct concatenation and improper query builder usage to ensure database security.
Static analysis finds SQL injection from improper ORM usage by scanning source code for unparameterized inputs and dynamic string concatenation. It detects unsafe practices across various frameworks where user input reaches raw SQL execution points without validation.
RaNDoM6913Audit backend source code for SQL injection, data mutation, and policy gaps.
DevelopersCoffeeReplace unsafe SQL string concatenation with parameterized statements in Java.
NickCrewIdentify OWASP Top 10 security vulnerabilities in web applications.
riparinoIdentifies and assesses OWASP Top 10-style SQL injection vulnerabilities in web applications.
