feat: add submitted skills review desk

2026-09-04 00:34:53 -03:00
parent a7034db94b
commit 82fff29571
57 changed files with 3380 additions and 1 deletions
@@ -0,0 +1,23 @@
+---
+name: sql-injection-audit
+description: Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.
+---
+
+# sql-injection-audit
+
+## Inputs
+Changed files, branch diff, or a named query path.
+
+## Workflow
+1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.
+2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.
+3. Review raw-query escape hatches and stored procedures.
+4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.
+
+## Rules
+- Escaping is not a substitute for parameterization.
+- Passing tests are supporting evidence, not proof of safety.
+- Do not modify code unless the user asks for a fix.
+
+## Output
+Return a findings table and the scope reviewed; say explicitly when a path could not be traced.