sqli

SQL Injection — automated and manual exploitation of unsanitized SQL queries. Covers Union-based, Error-based, Blind (Boolean/Time-based), and Stacked queries. Includes sqlmap automation with WAF bypass tamper scripts.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/sqli/SKILL.md

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and workflow-clear, with explicit escalation gates and feedback loops for batch extraction. Its main weakness is progressive disclosure: everything lives in one long monolithic file with no reference bundle, so navigability and content splitting could be improved.

Suggestions

Move the Blind SQLi Parallel Character Extraction Blueprint and the Post-Extraction Hash Cracking Workflow into separate reference files (e.g. references/blind-extraction.md, references/hash-cracking.md) linked one level deep from SKILL.md.

Consolidate the three overlapping blind-extraction sections (Fast-Path, Bulk Extraction Strategies, Parallel Blueprint) to remove redundant binary-search content and tighten conciseness.

Add a brief table of contents or "## Contents" section near the top so Claude can navigate the long single-file structure quickly.

Dimension	Reasoning	Score
Conciseness	Dense, command-first content that assumes Claude's competence with minimal prose padding; a few explanatory one-liners ("Narrows each character to 7 bits", "covers ~60% of CTF hashes") earn their place, but the overlapping blind-extraction material recurs across three sections (Fast-Path, Bulk Extraction Strategies, Parallel Blueprint) and could be consolidated.	4 / 5
Actionability	Fully executable, copy-paste-ready commands throughout (curl probes, sqlmap invocations with concrete flags, hashcat/john cracking, a python3 reconstruction snippet), covering the common detection, exploitation, and post-extraction cases concretely.	5 / 5
Workflow Clarity	Multi-step flows are explicitly sequenced with validation checkpoints and feedback loops — the escalation state table, "If either confirms… launch sqlmap IMMEDIATELY", "LET IT FINISH", "Submit/verify the partial result before launching a second harness", and "the NEXT bash call MUST launch the parallel extraction loop" — satisfying the batch/destructive feedback-loop requirement.	5 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ are absent) and the skill is a single 263-line monolithic SKILL.md with clear ## headers but no TOC and no one-level-deep references; substantial sub-procedures (parallel extraction blueprint, hash-cracking workflow) that could live in separate files are inlined.	3 / 5
	Total	17 / 20 Passed

Description

67%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped to a distinct SQL-injection niche, but it omits any explicit "Use when…" trigger guidance, relying on metadata.when_to_use for triggering instead. Adding a natural-language trigger clause would raise completeness and trigger-term quality.

Suggestions

Append a "Use when the user mentions SQL injection, sqlmap, union select, blind/boolean/time-based SQLi, or needs to dump a database via an unsanitized query" clause to the description so the 'when' is explicit.

Reframe the technique list as natural user phrasings (e.g. "database dump", "bypass a WAF on a SQL endpoint") alongside the technical taxonomy to improve trigger-term quality.

Keep the description in third person and avoid relying solely on metadata.when_to_use for discoverability, since the description field is the primary trigger surface.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and sub-techniques — "automated and manual exploitation", "Union-based, Error-based, Blind (Boolean/Time-based), and Stacked queries", "sqlmap automation with WAF bypass tamper scripts" — giving comprehensive coverage of the domain.	5 / 5
Completeness	Clearly answers "what" (exploitation of unsanitized SQL queries across the four types plus sqlmap automation) but provides no "when"/"Use when…" clause; per the rubric a missing explicit trigger guidance caps completeness at 3.	3 / 5
Trigger Term Quality	Contains relevant keywords (sqlmap, union select, blind, error-based, stacked queries) but presents them as technical taxonomy rather than the natural phrases a user would say, and lacks any "Use when…" trigger framing; the natural trigger list is sequestered in metadata.when_to_use instead of the description.	3 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (SQL injection specifically) with distinctive sub-technique triggers (union/error/blind/stacked, sqlmap tamper scripts) that minimize overlap with adjacent web-exploitation skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/sqli/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.