sqlmap-database-pentesting

This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-sequenced but suffers from token-heavy repetition and a monolithic structure with no progressive disclosure. Destructive operations also lack explicit validation feedback loops.

Suggestions

Move the six full Examples and the Troubleshooting catalog into separate reference files (e.g., examples.md, troubleshooting.md) linked one level deep, keeping SKILL.md as a lean overview.

De-duplicate repeated full commands by referencing the Quick Reference table instead of restating 'sqlmap -u "URL" --dbs --batch' with one flag change in every section.

Add explicit validation checkpoints before destructive/batch actions (e.g., verify enumeration counts before '--dump-all', confirm DBA privileges before '--os-shell'), to raise workflow clarity.

Dimension	Reasoning	Score
Conciseness	It avoids explaining concepts Claude already knows, but near-identical commands are repeated verbatim across the Core Workflow, Quick Reference tables, and six Examples (e.g., 'sqlmap -u "URL" --dbs --batch' restated with one flag change each), so it could be tightened significantly.	2 / 3
Actionability	Commands are fully executable and copy-paste ready, with specific flag explanations, concrete target examples (testphp.vulnweb.com), and complete option tables, matching the top anchor.	3 / 3
Workflow Clarity	The Core Workflow gives a clear 1-6 sequence and an initial manual-verification step, but destructive/batch operations like '--dump-all,' '--os-shell,' '--file-write,' and bulk scanning lack explicit validate-then-proceed checkpoints, capping this at 2 per the rubric.	2 / 3
Progressive Disclosure	No bundle files exist and the ~400-line body is monolithic; well-organized sections and tables provide structure, but content that could be split out (full Examples, Troubleshooting, DBMS support matrix) is all inline rather than behind one-level-deep references.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong across all dimensions: specific, action-oriented, with explicit 'use when' triggers and a well-scoped niche. It uses appropriate third-person voice and avoids vague fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions such as 'automate SQL injection testing,' 'enumerate database structure,' 'extract database credentials using sqlmap,' and 'dump tables and columns from a vulnerable database,' matching the top anchor for listing several specific actions.	3 / 3
Completeness	Explicitly answers both halves: the 'should be used when the user asks to...' clause states when, and 'It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities' states what, with explicit triggers present.	3 / 3
Trigger Term Quality	Includes natural phrases a user would say verbatim ('automate SQL injection testing,' 'enumerate database structure,' 'dump tables and columns,' 'perform automated database penetration testing'), giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	The niche is clearly SQLMap-driven SQL injection pentesting with tool-specific trigger terms, making it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/sqlmap-database-pentesting/SKILL.md
Commit: af7d491

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.