sql-injection

Detect unsafe SQL query construction from source code patterns.

39|4|Updated May 6, 2026

Search Tags:#static analysis #security #vulnerability #injection #sql #source code

Ready to run

npx skills add https://github.com/pruiz/CodeCome --skill sql-injection-pruiz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sql-injection
Source: https://github.com/pruiz/CodeCome/tree/main/.opencode/skills/sql-injection
Command: npx skills add https://github.com/pruiz/CodeCome --skill sql-injection-pruiz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps developers and security professionals detect unsafe SQL query construction that could be exploited by attackers to manipulate database operations.

Core Features & Use Cases

Vulnerability Detection: Scan source code for unsafe SQL concatenation and dynamic query building.
Scope Analysis: Identify code areas interacting with SQL databases across multiple languages and frameworks.
Use Case: When auditing a web application, use this Skill to pinpoint places where user input reaches raw SQL execution points without proper parameterization, thereby reducing security risks.

Quick Start

Use the sql-injection skill to analyze your project's source code for potential insecure SQL query patterns.

Frequently Asked Questions about sql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect SQL injection vulnerabilities in source code?▼

To detect SQL injection vulnerabilities, this Skill scans source code for unsafe query construction patterns like dynamic string concatenation and unparameterized inputs. It identifies areas where user input reaches raw SQL execution points without proper parameterization to reduce security risks.

What are common unsafe SQL query construction patterns in web applications?▼

Common unsafe SQL query construction patterns include direct string concatenation, unvalidated identifiers, and the improper use of ORM or query builders. These practices allow unparameterized user input to manipulate database operations and create injection vulnerabilities.

Can I scan for SQL injection across multiple programming languages and frameworks?▼

Yes, you can scan for SQL injection across multiple programming languages and frameworks. The analysis identifies code areas interacting with SQL databases and flags improper ORM or query builder usage regardless of the specific implementation language.

How to audit a web application for unparameterized database inputs?▼

To audit a web application for unparameterized database inputs, analyze your source code to pinpoint places where user input reaches raw SQL execution points. This process highlights direct concatenation and improper query builder usage to ensure database security.

Does static analysis find SQL injection from improper ORM usage?▼

Static analysis finds SQL injection from improper ORM usage by scanning source code for unparameterized inputs and dynamic string concatenation. It detects unsafe practices across various frameworks where user input reaches raw SQL execution points without validation.