sqli

Focused SQLi checklist — detection differentials, contexts, sqlmap handoff, proof standard.

IndexedMIT★ 1

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/venkatas-sqli

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Focused SQLi checklist — detection differentials, contexts, sqlmap handoff, proof standard.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/sqli

What's inside

Skill name: sqli
Description: Focused SQLi checklist — detection differentials, contexts, sqlmap handoff, proof standard.
License: MIT
Instructions: 21 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# SQL Injection

## Checklist
- [ ] Test EVERY input: query/body/JSON/cookies/headers (`User-Agent`, `X-Forwarded-For`, `Referer`)
- [ ] Numeric AND string contexts
- [ ] Differential pair: `'` vs `''`; `' AND 1=1-- -` vs `' AND 1=2-- -`
- [ ] Time-based fallback (0s/5s/10s) when errors suppressed
- [ ] Second-order sinks (store then use later)
- [ ] Hand off to **sqlmap** only after a manual positive signal

## Common bypasses
- Comment styles: `-- -`, `#`, `/* */`, balanced quotes
- Encoding / WAF: double URL-encode, case mix, inline comments `UN/**/ION`
- JSON/numeric without quotes: `1 AND 1=1`, `1-0`

## Proof standard
- Repeatable boolean differential, error oracle with DB signature, reproducible time delay (2–3×), or OOB DNS.
- A single 500 on `'` is NOT confirmation.
- Prefer `sqlmap --batch --level=3 --risk=2` for extraction after manual proof.

From venkatas/vikramaditya, MIT.

Signals

Stars: 1
Forks: 1
Open issues: 0
Last commit (this folder): Sep 7, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/venkatas/vikramaditya
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from venkatas

Cite this page

sqli skill. Agent Mart. https://agentmart.dev/skills/venkatas-sqli (last updated 2026-10-24)