New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Detecting SQL Injection Vulnerabilities

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Detect and analyze SQL injection vulnerabilities in application code and database queries.

MITAuto-check passedSecurity

Install Detecting SQL Injection Vulnerabilities

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-sql-injection-vulnerabilities -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace detecting-sql-injection-vulnerabilities --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/detecting-sql-injection-vulnerabilities .claude/skills/detecting-sql-injection-vulnerabilities && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
detecting-sql-injection-vulnerabilities
GitHub stars
2.8k
Token cost
~1.6k tokens
SKILL.md length
606 words
Files
9 (incl. scripts, references, assets)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Detect and analyze SQL injection vulnerabilities in application code and database queries.

  • Works in 9 steps: Discover database interaction code:… → Identify input surfaces: map all… → Trace data flows: follow each input… → …
  • You need to scan code for SQL injection risks
  • SKILL.md covers Overview, Prerequisites, Instructions and Output, plus 3 more sections
  • Review query construction

What it does

Detecting SQL Injection Vulnerabilities is an agent skill from jeremylongshore/tons-of-skills-marketplace. Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction, validate input sanitization, or implement secure query patterns. Trigger with phrases like "detect SQL injection", "scan for SQLi vulnerabilities", "review database queries", or "check SQL security".

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 11 other files, including scripts, reference files and assets (for example `assets/README.md`, `assets/sqli_payloads.json` and `references/README.md`). Compatibility notes: Designed for Claude Code

It sits in Security, covering Web application vulnerabilities. It works with SQL. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • You need to scan code for SQL injection risks
  • Review query construction
  • Validate input sanitization
  • Implement secure query patterns

Example prompts

  • “detect SQL injection”
  • “scan for SQLi vulnerabilities”
  • “review database queries”
  • “/detecting-sql-injection-vulnerabilities”

Requirements

  • Python 3
  • Node.js
  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(code-scan:*), Bash(security-test:*)

Workflow steps

9 steps, taken from the first numbered list in SKILL.md.

  1. Discover database interaction code: search for SQL keywords (SELECT, INSERT, UPDATE, DELETE, EXEC) and ORM raw query methods (raw()…
  2. Identify input surfaces: map all user-controllable data entry points -- HTTP parameters, request bodies, URL path segments, headers…
  3. Trace data flows: follow each input surface through the code to determine whether user data reaches a SQL query. Flag any path where input…
  4. Detect vulnerable patterns
  5. Classify each finding: assign CVSS 3.1 score, identify attack type (classic injection, blind boolean/time-based, UNION-based exfiltration…
  6. Assess impact per finding: determine data exposure scope (authentication bypass, data exfiltration, data modification, OS command…
  7. Generate remediation code: provide parameterized equivalents for each vulnerable query. Use framework-idiomatic patterns -- %s…
  8. Recommend defense-in-depth measures: input validation (allowlists over denylists), stored procedures with parameterized calls…
  9. Produce the vulnerability report at ${CLAUDE_SKILL_DIR}/security-reports/sqli-scan-YYYYMMDD.md with per-finding severity, CWE-89 mapping…

What it can do on your machine

Read from SKILL.md and the folder at commit 80f86df. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Grep
    • Glob
    • Bash(code-scan:*)
    • Bash(security-test:*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/, which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • cheatsheetseries.owasp.org
    • cwe.mitre.org
    • owasp.org
    • capec.mitre.org
    • intentsolutions.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Detecting SQL Injection Vulnerabilities loads about 1.6k tokens when it runs, and up to ~2.6k if it reads all its reference files. Until then it costs about 103 tokens; SKILL.md has 606 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~103
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit 80f86df, republished under its MIT licence (© jeremylongshore). 606 words, ~1,584 tokens.

Download SKILL.mdSave it as .claude/skills/detecting-sql-injection-vulnerabilities/SKILL.md (or your agent's skills folder). This skill also uses 8 other files; get the full folder from GitHub.
name
detecting-sql-injection-vulnerabilities
description
Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction, validate input sanitization, or implement secure query patterns. Trigger with phrases like "detect SQL injection", "scan for SQLi vulnerabilities", "review database queries", or "check SQL security".
allowed-tools
Read, Write, Edit, Grep, Glob, Bash(code-scan:*), Bash(security-test:*)
compatibility
Designed for Claude Code
version
1.31.0
author
Jeremy Longshore <jeremy@intentsolutions.io>
license
MIT
tags
security, database, detecting-sql

Detecting SQL Injection Vulnerabilities

Overview

Scan application source code for SQL injection vulnerabilities (CWE-89, OWASP A03:2021) by tracing user input from entry points through data flows into database query construction. Detect string concatenation, format string interpolation, and inadequate parameterization across raw SQL, ORM raw query methods, stored procedure calls, and dynamic query builders.

Prerequisites

  • Application source code accessible in ${CLAUDE_SKILL_DIR}/
  • Database query files, ORM models, and repository/DAO layers available
  • Framework and language identified (Django, Rails, Express, Spring, Laravel, ASP.NET, Go, etc.)
  • Database type known (MySQL, PostgreSQL, SQLite, MSSQL, Oracle) for syntax-specific detection
  • Write permissions for reports in ${CLAUDE_SKILL_DIR}/security-reports/

Instructions

  1. Discover database interaction code: search for SQL keywords (SELECT, INSERT, UPDATE, DELETE, EXEC) and ORM raw query methods (raw(), execute(), createNativeQuery(), $wpdb->query()) across all source files.
  2. Identify input surfaces: map all user-controllable data entry points -- HTTP parameters, request bodies, URL path segments, headers, cookies, file uploads, and WebSocket messages.
  3. Trace data flows: follow each input surface through the code to determine whether user data reaches a SQL query. Flag any path where input is not passed through parameterized query binding.
  4. Detect vulnerable patterns:
    • String concatenation: "SELECT * FROM users WHERE id=" + userId
    • f-string/format interpolation: Python f-strings embedding variables directly into SQL strings
    • Template literals: `SELECT * FROM users WHERE id=${req.params.id}`
    • ORM raw queries without bindings: Model.objects.raw("SELECT * FROM t WHERE x='" + val + "'")
  5. Classify each finding: assign CVSS 3.1 score, identify attack type (classic injection, blind boolean/time-based, UNION-based exfiltration, second-order/stored injection), and document exploitability (authentication required, network access).
  6. Assess impact per finding: determine data exposure scope (authentication bypass, data exfiltration, data modification, OS command execution via xp_cmdshell or LOAD_FILE()).
  7. Generate remediation code: provide parameterized equivalents for each vulnerable query. Use framework-idiomatic patterns -- %s placeholders for Python DB-API, ? for Node.js, $1 for PostgreSQL, named parameters for Spring JPA.
  8. Recommend defense-in-depth measures: input validation (allowlists over denylists), stored procedures with parameterized calls, least-privilege database accounts, WAF rules, and ORM-only data access policies.
  9. Produce the vulnerability report at ${CLAUDE_SKILL_DIR}/security-reports/sqli-scan-YYYYMMDD.md with per-finding severity, CWE-89 mapping, file path and line number, vulnerable code snippet, attack vector demonstration, and remediated code.

See ${CLAUDE_SKILL_DIR}/references/implementation.md for the detection pattern library. See ${CLAUDE_SKILL_DIR}/references/critical-findings.md for example vulnerability write-ups with attack demonstrations.

Show full SKILL.md (241 more words)Show less

Output

  • Vulnerability Report: ${CLAUDE_SKILL_DIR}/security-reports/sqli-scan-YYYYMMDD.md with all findings classified by severity
  • Finding Details: per-finding file path, line number, vulnerable code, attack vector, CVSS score, and remediation code
  • Remediation Summary: parameterized query replacements grouped by language/framework
  • Defense Recommendations: input validation rules, database privilege changes, and WAF configuration

Error Handling

ErrorCauseSolution
Unknown ORM or database frameworkCustom or uncommon data access libraryApply generic SQL injection pattern detection; note limited framework-specific guidance
Cannot analyze compiled/minified codeProduction bundles or bytecode instead of sourceRequest unminified source; document reduced detection accuracy
False positive on sanitized inputProper sanitization exists but not recognizedTrace sanitization implementation manually; whitelist verified-safe patterns
Complex dynamic query builder logicMulti-step query construction across modulesTrace full data flow manually; flag for manual security review
Cannot analyze stored procedure definitionsSQL source files not available in ${CLAUDE_SKILL_DIR}/Request .sql files or database schema exports; focus on application-layer code

Examples

  • "Scan the codebase for SQL injection risks in dynamic query construction, focusing on controllers and API handlers."
  • "Review these query snippets and propose parameterized equivalents with unit tests validating the fix."
  • "Detect second-order SQL injection in the user profile update flow where stored data is later used in admin queries."

Resources

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 8 other files (scripts, references, assets) in skills/.curated/detecting-sql-injection-vulnerabilities of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • assets/README.md
  • assets/sqli_payloads.json
  • references/README.md
  • references/critical-findings.md
  • references/errors.md
  • references/examples.md
  • references/implementation.md
  • scripts/README.md

Open the folder on GitHubat commit 80f86df

Compare with similar skills

Detecting SQL Injection Vulnerabilities next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Detecting SQL Injection Vulnerabilities compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Detecting SQL Injection Vulnerabilities this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.6kAutomated safety check: PassMIT
Secknowledge SkillPa55w0rd/secknowledge-skill424—~2.7kAutomated safety check: PassNone
SecskillsArenbai/SecSkills251—~1.8kAutomated safety check: NotesMIT
Code Security AuditProgrammerAnthony/Expert-Coding-Harness235—~1.6kAutomated safety check: PassMIT
Php Codeigniter Audit0xShe/PHP-Code-Audit-Skill4021 repos~477Automated safety check: PassNone
Security ReviewerAratKruglik/claude-laravel1551 repos~1.1kAutomated safety check: NotesNone

Similar skills

  • Secknowledge Skill

    Pa55w0rd/secknowledge-skill

    Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。

    424 GitHub stars~2.7k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Secskills

    Arenbai/SecSkills

    渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。

    251 GitHub stars~1.8k tokensUpdated 10 days ago
    SecurityAuto-check: notes

  • Code Security Audit

    ProgrammerAnthony/Expert-Coding-Harness

    A skill your agent uses when 用户需要对代码进行安全审计、发现安全漏洞、上线前安全评估、检查代码是否存在安全风险时。触发场景：代码安全审计、安全审计、白盒审计、安全扫描、漏洞检测、漏洞挖掘、SQL注入、命令注入、XSS、SSRF、反序列化、认证绕过、越权、代码安全检查、security audit、code…

    235 GitHub stars~1.6k tokensUpdated 5 mo ago
    SecurityAuto-check passed

  • Php Codeigniter Audit

    0xShe/PHP-Code-Audit-Skill

    CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。

    402 GitHub starsUsed in 1 repo~477 tokens
    SecurityAuto-check passed

  • Security Reviewer

    AratKruglik/claude-laravel

    A skill your agent uses when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security.

    155 GitHub starsUsed in 1 repo~1.1k tokens
    SecurityAuto-check: notes

  • TS Review

    liuyanghejerry/Clausura

    TypeScript monorepo 审查：XSS、SQL 注入、密钥、any、console.log. An agent skill from liuyanghejerry/Clausura.

    204 GitHub stars~166 tokensUpdated 10 days ago
    SecurityAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Detecting SQL Injection Vulnerabilities

What does Detecting SQL Injection Vulnerabilities do?

Detect and analyze SQL injection vulnerabilities in application code and database queries. Detecting SQL Injection Vulnerabilities is an agent skill from jeremylongshore/tons-of-skills-marketplace. Detect and analyze SQL injection vulnerabilities in application code and database queries.

When should I use Detecting SQL Injection Vulnerabilities?

Detecting SQL Injection Vulnerabilities fits situations like: you need to scan code for SQL injection risks; review query construction; validate input sanitization; implement secure query patterns.

How do I install Detecting SQL Injection Vulnerabilities in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-sql-injection-vulnerabilities -a claude-code`. Or copy the skill folder (skills/.curated/detecting-sql-injection-vulnerabilities in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/detecting-sql-injection-vulnerabilities in your project. Claude Code loads it when a task matches its description.

How do I install Detecting SQL Injection Vulnerabilities in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-sql-injection-vulnerabilities -a codex`. Or copy the skill folder (skills/.curated/detecting-sql-injection-vulnerabilities in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/detecting-sql-injection-vulnerabilities in your project. Codex loads it when a task matches its description.

Can I use Detecting SQL Injection Vulnerabilities in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-sql-injection-vulnerabilities -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/detecting-sql-injection-vulnerabilities, .gemini/skills/detecting-sql-injection-vulnerabilities, .github/skills/detecting-sql-injection-vulnerabilities and .opencode/skills/detecting-sql-injection-vulnerabilities in your project.

What does Detecting SQL Injection Vulnerabilities need to run?

SKILL.md names no scripts, command-line tools or credentials: Detecting SQL Injection Vulnerabilities is instructions for the agent only. Our summary lists: Python 3; Node.js. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep, Glob, Bash(code-scan:*), Bash(security-test:*). Compatibility (from SKILL.md): Designed for Claude Code.

Does Detecting SQL Injection Vulnerabilities access the network?

SKILL.md names 5 domains. As links in the text: cheatsheetseries.owasp.org, cwe.mitre.org, owasp.org, capec.mitre.org and intentsolutions.io. This is read from the text; nothing was executed.

Is Detecting SQL Injection Vulnerabilities safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Detecting SQL Injection Vulnerabilities use?

Detecting SQL Injection Vulnerabilities is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Detecting SQL Injection Vulnerabilities use?

About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1k tokens, read only when the agent opens those files.

What are the alternatives to Detecting SQL Injection Vulnerabilities?

Skills that share tags, products or a category with Detecting SQL Injection Vulnerabilities: Secknowledge Skill (Pa55w0rd/secknowledge-skill, 424 stars), Secskills (Arenbai/SecSkills, 251 stars), Code Security Audit (ProgrammerAnthony/Expert-Coding-Harness, 235 stars) and Php Codeigniter Audit (0xShe/PHP-Code-Audit-Skill, 402 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Detecting SQL Injection Vulnerabilities?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,825 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 9, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.