vuln-injection

Detect SQL, command, SSTI, XSS, and NoSQL injection vulnerabilities in web and API code.

Updated Jun 23, 2024

Search Tags:#vulnerability #xss #injection #sql-injection #command-injection #security-scanning #nosql-injection

Ready to run

npx skills add https://github.com/n4igme/randscript --skill vuln-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vuln-injection
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/scode/vuln-injection
Command: npx skills add https://github.com/n4igme/randscript --skill vuln-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Injection flaws arise when user input reaches interpreters without proper sanitization, enabling attackers to manipulate queries or commands. This Skill automates detection and reporting to streamline remediation.

Core Features & Use Cases

Pattern-based detection of SQL, command, SSTI, XSS, and NoSQL injections
Traceability from user input to risky sinks to support remediation planning
Reports appended to vulnerabilities.md to maintain ongoing findings

Quick Start

Run vuln-injection on your codebase to scan for common injection flaws and append results to vulnerabilities.md.

Frequently Asked Questions about vuln-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for SQL and command injection vulnerabilities?▼

To scan for SQL and command injection vulnerabilities, apply pattern-based detection to trace user input from sources to risky sinks. This identifies flaws where unsanitized data manipulates queries and appends findings to vulnerabilities.md.

What is backtracking from sinks to sources in injection detection?▼

Backtracking from sinks to sources is an analysis method that traces dangerous interpreter calls back to user input entry points. It prioritizes threat-model targets to accurately identify SQL, SSTI, XSS, and NoSQL injection scenarios across web and API code.

Can I detect SSTI and NoSQL injection flaws across web and API code?▼

Yes, you can detect SSTI and NoSQL injection flaws across web and API code. The scan applies pattern-based analysis to identify where user input reaches dangerous interpreters without proper sanitization across these specific scenarios.

How are detected injection vulnerabilities documented and reported?▼

Detected injection vulnerabilities are documented by appending results to vulnerabilities.md. This maintains ongoing findings and provides traceability from user input to risky sinks to support remediation planning for SQL, command, and XSS flaws.

Does this injection scan require any external dependencies or components?▼

No, this injection scan does not require external dependencies or components. It natively performs pattern-based analysis and backtracking from sinks to sources across web and API code without needing additional environment setup.