---
name: sql-injection-audit
description: Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.
---

# sql-injection-audit

## Inputs
Changed files, branch diff, or a named query path.

## Workflow
1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.
2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.
3. Review raw-query escape hatches and stored procedures.
4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.

## Rules
- Escaping is not a substitute for parameterization.
- Passing tests are supporting evidence, not proof of safety.
- Do not modify code unless the user asks for a fix.

## Output
Return a findings table and the scope reviewed; say explicitly when a path could not be traced.