Perform authorized security tests to detect, exploit, and validate defenses against SQL injection vulnerabilities in web applications.
Security Analysis
high confidenceThe skill is an instruction-only SQL injection testing guide whose requirements and content match its stated purpose; it contains offensive payloads (including OOB exfil examples) which are expected for this purpose and do not request extra privileges or credentials.
The name/description (SQL Injection Testing) match the SKILL.md content: detection, exploitation, and defense validation techniques. The skill declares no binaries, env vars, or install steps — consistent with an instruction-only reference. The offensive payloads and tool mentions are appropriate for a penetration-testing guide.
The instructions include full exploit payloads (boolean, time-based, UNION/error-based), authentication-bypass examples, and Out-of-Band (OOB) exfiltration payloads that reference contacting external hosts (e.g., attacker-server.com). While coherent with security testing, these instructions can directly enable data exfiltration and unauthorized access if misused. The doc does not instruct the agent to read local files or environment variables, and it includes an explicit legal/authorization warning, but the presence of OOB examples and explicit exfil payloads elevates operational risk.
No install spec and no code files — instruction-only. This minimizes on-disk code execution risk; nothing is downloaded or installed by the skill itself.
The skill requests no environment variables, credentials, or config paths. Required access is minimal and proportionate to an instruction-only testing guide.
always is false and the skill is user-invocable. Model invocation is allowed (platform default). The skill does not request persistent system-wide changes or other skills' credentials. Note: allowing autonomous invocation for a capability that includes active exploit steps increases potential blast radius, but autonomous invocation by itself is normal and not flagged here.
Guidance
This is a coherent and complete SQL injection testing guide — useful for authorized pentesting. Before using it: (1) ensure you have written authorization for the target and avoid production systems with real user data; (2) run tests only in isolated staging/test environments to prevent accidental data leakage or downtime; (3) restrict agent/network egress during testing (OOB payloads reference external hosts and could exfiltrate data if executed against a live system); (4) monitor and log all test activity and remove the skill or revoke any granted access when finished; (5) if you need automation, prefer vetted tooling (sqlmap, Burp) or explicitly controlled scripts rather than free-form instructions executed autonomously by an agent. If you want a lower-risk mode, ask for a version limited to detection guidance without exploitation or OOB examples.
Latest Release
v1.0.0
Initial release: Detection, exploitation, bypass techniques, prevention patterns
More by @brandonwise
Published by @brandonwise on ClawHub
