sast-sqli

Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/sqli-results.md. Use when asked to find SQLi or database injection bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced workflow with strong validation checkpoints, but it is a long monolithic file that explains some concepts Claude already knows and keeps large reference catalogs inline rather than splitting them into bundle files.

Suggestions

Trim or remove the 'What is SQL Injection' intro paragraph and lean on the IS/IS NOT classification lists, which already carry the useful disambiguation without restating the concept.

Move the per-stack Vulnerable vs. Secure Examples catalog into a references/ file (e.g. references/examples.md) and link to it one level deep, keeping SKILL.md as an overview plus the execution workflow.

Move the full Phase 1/Phase 2 subagent prompt templates into a references/ file (e.g. references/subagent-prompts.md) and reference them by name, reducing the inline token weight while preserving copy-paste usability.

Dimension	Reasoning	Score
Conciseness	Mostly actionable, but the opening 'What is SQL Injection' section explains a concept Claude already knows and the ~200-line multi-language vulnerable/secure catalog plus full subagent prompt templates could be tightened or offloaded. Not a score of 3 because some tokens do not earn their place; not a 1 because the bulk is concrete reference material rather than padded fluff.	2 / 3
Actionability	Provides fully executable vulnerable/secure code examples across stacks, exact subagent instruction templates, concrete file paths (sast/sqli-recon.md, sast/sqli-batch-N.md), and copy-paste output formats with classification rubrics.	3 / 3
Workflow Clarity	Three phases are clearly sequenced with an explicit validation checkpoint after Phase 1 ('If the recon found zero vulnerable construction sites...skip Phase 2 entirely'), parallel batching rules, dependency ordering, and cleanup steps for the batch operation.	3 / 3
Progressive Disclosure	No references/scripts/assets bundle exists, so a 533-line SKILL.md is monolithic; the large example catalog and verbose subagent prompt templates are content that should be split into one-level-deep reference files. Not a 3 because this is far over 50 lines with no external references; not a 1 because sections are well-organized with clear headers.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete actions, gives natural trigger terms, and explicitly states both what it does and when to use it in third-person voice. No meaningful weaknesses against the rubric.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'recon (find unsafe SQL construction sites)', 'batched verify (trace user input...in parallel subagents, 3 sites each)', 'merge (consolidate batch results)' — plus specific pattern coverage ('string concat, f-strings, unsafe ORM methods, and dynamic identifiers').	3 / 3
Completeness	Explicitly answers both what (three-phase detection approach with concrete outputs) and when via the 'Use when asked to find SQLi or database injection bugs' trigger clause.	3 / 3
Trigger Term Quality	Uses natural terms a user would say — 'SQL injection', 'SQLi', 'database injection bugs' — covering common variations rather than only technical jargon.	3 / 3
Distinctiveness Conflict Risk	Clear niche (SQL injection detection with a defined three-phase pipeline and a hard prerequisite on sast/architecture.md) and distinct triggers make it unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (534 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-sqli/SKILL.md
Commit: db52227

Reviewed: about 18 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.