Name: sast-sqli
Rating: 66.4 (1 reviews)
Author: utkusen

sast-sqli

Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/sqli-results.md. Use when asked to find SQLi or database injection bugs.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./sast-files/.claude/skills/sast-sqli/SKILL.md

The canonical home for this skill is sast-sqli in utkusen/sast-skills

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with a clear, well-gated three-phase workflow, but it is token-heavy for a single file: a concept primer and a large multi-language example catalogue are inlined where reference files would improve token efficiency and navigation.

Suggestions

Move the per-language "Vulnerable vs. Secure Examples" catalogue into a references/ file (e.g. references/examples.md) and inline only the matching stack examples per Phase 2, reducing SKILL.md token weight.

Drop or condense the "What is SQL Injection" primer and "What SQLi IS / IS NOT" disambiguation to the minimum needed for false-positive avoidance, since Claude already knows the core concept.

Add an explicit error-recovery feedback loop for Phase 2 (e.g., if a batch file is malformed or a taint trace is inconclusive, re-run that batch with clarified instructions before merging).

Dimension	Reasoning	Score
Conciseness	Mostly efficient actionable content, but it opens with a "What is SQL Injection" concept primer Claude already knows and inlines 10+ language vulnerable/secure example sets that could be trimmed or moved to references.	3 / 5
Actionability	Fully executable: copy-paste-ready subagent prompts with exact output-format templates, concrete vulnerable/secure code, specific batching steps, file paths, and sqlmap dynamic-test examples covering common cases.	5 / 5
Workflow Clarity	Three phases are clearly sequenced with explicit dependency gates and a Phase-1 zero-candidate validation checkpoint, but there is no error-recovery feedback loop for malformed or failed batch output.	4 / 5
Progressive Disclosure	Section headers are well-organized, but no bundle/reference files exist and bulk reference-grade content (multi-language examples, preventive-pattern catalogue) is inlined in the SKILL.md rather than split into one-level-deep reference files.	3 / 5
	Total	15 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly conveys both the capability and its trigger conditions with good synonym coverage. Minor room to widen trigger phrasing and sharpen distinctiveness from sibling SAST skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (recon, batched verify, merge) and comprehensively covers the vulnerable patterns (string concat, f-strings, unsafe ORM methods, dynamic identifiers), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what (three-phase detection approach and covered patterns) and when ("Use when asked to find SQLi or database injection bugs.") with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Includes natural synonyms users would say ("SQL injection", "SQLi", "database injection") in the trigger clause, but misses a few natural variants a user might utter such as "injection vulnerability" or "DB injection".	4 / 5
Distinctiveness Conflict Risk	Has a clear SQLi niche with distinct triggers, but belongs to a SAST skill family (prerequisite sast-analysis) creating minor overlap risk with closely related security-detection skills.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (534 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-sqli/SKILL.md
Commit: db52227

Reviewed: 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.