sast-sqli
Detects SQL injection vulnerabilities in codebases using a structured three-phase approach for enhanced security assessments.
Install this skill
Security score
The sast-sqli skill was audited on Jun 13, 2026 and we found 8 security issues across 2 threat categories, including 4 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 84 | await prisma.$queryRaw`SELECT * FROM users WHERE id = ${userId}` |
Template literal with variable interpolation in command context
| 159 | const [rows] = await db.query(`SELECT * FROM users WHERE id = ${id}`); |
Template literal with variable interpolation in command context
| 177 | const result = await pool.query(`SELECT * FROM orders WHERE status = '${status}'`); |
Template literal with variable interpolation in command context
| 319 | > - `` db.query(`SELECT * WHERE id = ${var}`) `` |
Template literal with variable interpolation in command context
| 331 | > - Sequelize: `` sequelize.query(`...${var}...`) ``, `literal(var)` |
Template literal with variable interpolation in command context
| 332 | > - TypeORM: `` createQueryBuilder().where(`col = '${var}'`) ``, `.query("..." + var)` |
Template literal with variable interpolation in command context
| 338 | > - `` `SELECT * FROM ${tableVar}` `` |
External URL reference
| 458 | > Example: sqlmap -u "https://app.example.com/search?q=test" -p q --dbs] |