skills/jeremylongshore/claude-code-plugins-plus/detecting-sql-injection-vulnerabilities/Gen Agent Trust Hub
detecting-sql-injection-vulnerabilities
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool withsecurity-testandcode-scanprofiles to run vulnerability detection and exploitation scripts. It references bundled Python scripts (sqli_scan.py,sqli_exploit.py) that use the payloads defined inassets/sqli_payloads.jsonto interact with code and potentially live targets.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted application source code. Maliciously crafted files within the analyzed codebase could contain instructions intended to redirect the agent's behavior.\n - Ingestion points: Source code files read from
${CLAUDE_SKILL_DIR}/usingRead,Grep, andGlobtools.\n - Boundary markers: No delimiters or instructions to ignore embedded commands are specified in the prompt logic.\n
- Capability inventory: The skill has access to
Write,Edit, andBashtools, which could be abused if an injection is successful.\n - Sanitization: There is no documented validation or sanitization of the content extracted from the analyzed files.
Audit Metadata