blind-sqli

Blind SQL injection under hostile WAF — manual bypass playbook for when sqlmap fails because common tokens (SUBSTRING, IF, AND, WHERE, single quotes) are filtered. Covers token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search. Loaded on top of sqli.md when the binary oracle exists but tampers can't pass the WAF.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced playbook with executable code and proper validation gates for a batch extraction workflow. The only soft spot is conciseness/structure: a few prose justifications could be trimmed and some material (probe matrix, substitution map) could optionally live in reference files.

Suggestions

Trim justifying asides like the '~70% of round-trip cost' rationale to tighten conciseness without losing the actionable guidance.

Consider moving the WAF token sniff matrix and substitution map into a references/ file (e.g. SUBSTITUTIONS.md) to improve progressive disclosure and shorten the main SKILL.md.

Add a one-line explicit concurrency caveat near Step 5 noting that parallelizing positions requires per-position state isolation, since the existing note only says bit-bisection must stay serial.

Dimension	Reasoning	Score
Conciseness	Mostly lean and assumes competence (no preamble explaining what SQLi or a WAF is), with a few justifying asides such as "One script run beats 15 sequential bash calls (saves ~70% of the round-trip cost)" that could be trimmed.	4 / 5
Actionability	Copy-paste-ready bash probe scripts, concrete SQL payloads, and a hex() helper cover the common cases end-to-end with no pseudocode gaps.	5 / 5
Workflow Clarity	A clearly numbered sequence (oracle confirmation → fingerprint → boolean eval → hex → length search → extraction → sanity gate) with explicit validation checkpoints and an abort-on-empty feedback loop in Step 6; the batch-operation cap does not apply because validation is present.	5 / 5
Progressive Disclosure	Well-organized with clear section headers and a one-level companion reference (sqli.md), but all ~214 lines live inline in SKILL.md with no bundle files; structure is good though slightly long for a single file.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, well-scoped description that names concrete capabilities and gives explicit load-conditions with a clear companion-skill boundary. Slightly stronger on completeness and specificity than on raw trigger-term synonym coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search" — giving comprehensive coverage of what the skill does.	5 / 5
Completeness	Explicitly answers both what (the bypass playbook and its four techniques) and when ("for when sqlmap fails because common tokens are filtered" / "Loaded on top of sqli.md when the binary oracle exists but tampers can't pass the WAF").	5 / 5
Trigger Term Quality	Natural terms like "Blind SQL injection", "hostile WAF", "sqlmap fails", and "WAF bypass" are present, but a few common synonyms (e.g. "boolean-based sqli") appear only in metadata rather than the description itself.	4 / 5
Distinctiveness Conflict Risk	The niche is sharply defined — blind SQLi under a hostile WAF when sqlmap tamper fails, layered on top of sqli.md — so conflict with sibling skills is minimal.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.