ai-for-dummies/skill-reviews/improved/sql-injection-audit/SKILL.md

name, description

name	description
sql-injection-audit	Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.

sql-injection-audit

Inputs

Changed files, branch diff, or a named query path.

Workflow

1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.
2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.
3. Review raw-query escape hatches and stored procedures.
4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.

Rules

• Escaping is not a substitute for parameterization.
• Passing tests are supporting evidence, not proof of safety.
• Do not modify code unless the user asks for a fix.

Output

Return a findings table and the scope reviewed; say explicitly when a path could not be traced.