Agent skill · security · jeremylongshore
detecting-sql-injection-patterns
Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements. Use when: pre-commit code review, post-feature SQL-touching release, inheriting a legacy codebase that predates ORMs, or post-bug-report investigation. Threshold: any source line where SQL keywords (SELECT / INSERT / UPDATE / DELETE / FROM / WHERE) appear in a string that's being built via concatenation, f-string, %-format, or .format() with variable input. Trigger with: "scan for sqli", "sql injection patterns", "check raw queries", "audit cursor.execute".
Why this skill is useful
Adds specific detection patterns for SQL injection vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting SQL Injection Patterns Overview SQL injection (CWE-89, OWASP A03:2021) remains one of the highest- impact and most-easily-introduced vulnerability classes. The fix is near-universal: use parameterized queries. The cause when introduced: an engineer concatenates user input into a SQL string because the ORM's parameterization mechanism wasn't obvious, or because they "just need to add a quick condition." The scanner reads source files and grades each apparent SQL-string construction against the threshold table. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- f-string with SQL keywords + user input CRITICAL f"SELECT FROM users WHERE id = {userid}" CWE-89 String concat into SQL keyword string CRITICAL "SELECT ... " + var + " ..." CWE-89 %-format SQL string HIGH "SELECT FROM %s" % tablename CWE-89 .format() into SQL string HIGH "SELECT {} FROM users".format(col) CWE-89 cursor.execute(f"...") CRITICAL f-string passed directly to cursor.execute CWE-89 sequelize.query with template literal HIGH sequelize.query(\SELECT FROM ${table}\) CWE-89 Knex / sequelize raw() with interpolation HIGH knex.raw('SELECT FROM ' + table) CWE-89 Django .extra() with raw SQL MEDIUM Model.objects.extra(where=['col = ' + val]) CWE-89 cursor.executemany with string-built query CRITICAL Same risk as execute CWE-89 JDBC Statement.execute with concat HIGH Java pattern: not PreparedStatement CWE-89 Rails where() with string interpolation HIGH User.where("name = '#{name}'") CWE-89 Go db.Query with fmt.Sprintf HIGH db.Query(fmt.Sprintf("...", arg)) CWE-89 Prerequisites Python 3.9+ Target source tree on local filesystem Instructions Step 1 — Run the scanner Options: Step 2 — Interpret findings CRITICAL = direct user-input → query string construction. Fix the specific query AND audit nearby code for the same pattern. HIGH = pattern suggests interpolation but might be a fixed identifier (table/column name). Verify by reading the code. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-sql-injection-patterns--13de7c