offensive-sqli

SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, token-efficient SQLi cheatsheet with concrete executable payloads and clean section structure. Its main weaknesses are the lack of validation/verification checkpoints in destructive and batch automation workflows, and a monolithic single-file layout that inlines reference material which should be split into bundle files.

Suggestions

Add explicit validation/verification checkpoints to the Quick Workflow and automation pipeline — e.g., a 'Verify findings' step that manually confirms each sqlmap result before trusting it, and a confirm-scope/authorization check before destructive payloads like DROP TABLE or INTO OUTFILE webshells.

Split the document into one-level-deep bundle files under references/ (e.g., db-specific-exploits.md, waf-bypass.md, cloud-attack-paths.md, orm-cves.md, detection-queries.md) and keep SKILL.md as a concise overview with clearly signaled links to them.

Flag time-sensitive material (the 'ORM CVE Tracking (2023–2025)' table and the Neo4j CVE-2024-34517 reference) as a dated/deprecated-style section so version staleness does not silently degrade the guidance.

Dimension	Reasoning	Score
Conciseness	The body is a lean cheatsheet of payloads, commands, and tables with no padding and no explanation of basic concepts Claude already knows (e.g., what SQL or a database is); every section — probes, DB-specific exploits, WAF bypass table, ORM CVE table — earns its tokens, matching the 'lean and efficient; assumes Claude's competence' anchor.	5 / 5
Actionability	It provides copy-paste-ready payloads and commands throughout — UNION column-count probes, sqlmap/ghauri pipelines, xp_cmdshell and COPY-FROM-PROGRAM RCE, MongoDB operator injection — covering the common cases with fully executable examples, matching the 'fully executable; copy-paste ready code or commands' anchor.	5 / 5
Workflow Clarity	The 'Quick Workflow' lists a clear 5-step sequence, but the automation and exploitation flows involve destructive/batch operations (`sqlmap -m sqli --dbs --batch`, `DROP TABLE`, `INTO OUTFILE` webshells) with no validation or verification checkpoints, triggering the cap that destructive/batch skills without validation cannot score above 3; it is not a 4 because checkpoints are entirely absent rather than merely minor gaps.	3 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ are absent) and all content is inlined into one ~365-line document; self-contained reference material such as the DB-specific exploits, cloud attack paths, ORM CVE table, and Splunk/CloudWatch monitoring queries that clearly belong in separate files are kept inline with section headers but no file-level split, fitting the 'some structure but could be better organized; content that should be separate is inline' anchor rather than a 4.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly answers both what the skill does and when to invoke it, with comprehensive capability coverage and a distinct offensive-SQLi niche. The only minor weakness is keyword coverage skewing toward jargon over plain-language synonyms.

Dimension	Reasoning	Score
Specificity	The description enumerates many concrete capability categories — 'error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi' plus 'WAF bypass techniques, database-specific exploitation ... cloud-native attack paths, ORM CVE tracking, and SQLmap automation' — matching the 'multiple specific concrete actions; comprehensive coverage' anchor.	5 / 5
Completeness	It states a clear 'what' (the listed technique and capability categories) and an explicit 'when' via 'Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks', matching the 'clearly and explicitly answers both what AND when' anchor.	5 / 5
Trigger Term Quality	Natural phrases users would say appear — 'SQL injection testing', 'database enumeration', 'privilege escalation via SQLi', 'injection vectors in APIs and modern stacks' — but coverage leans on technical jargon and is missing some plain-synonym variations, fitting the 'good keyword coverage; a few natural terms missing' anchor rather than a full 5.	4 / 5
Distinctiveness Conflict Risk	The niche is sharply defined as offensive SQL-injection testing with distinct triggers ('SQLi', 'database enumeration', 'injection vectors in APIs'), giving it minimal overlap with adjacent skills and matching the 'clear niche with distinct triggers; minimal conflict risk' anchor.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/web/offensive-sqli/SKILL.md
Commit: 24d7968

Reviewed: ~5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.