Agent Skills › cisco-ai-defense/skill-scanner › interpolated-database-query

interpolated-database-query

GitHub

识别并保留历史不安全的数据库查询字符串拼接模式，仅用于静态分析，不接触真实数据库。

evals/skills/sql-injection/database-query/SKILL.md cisco-ai-defense/skill-scanner

Trigger Scenarios

代码审查中发现动态构建SQL查询静态分析检测潜在SQL注入风险

Install

npx skills add cisco-ai-defense/skill-scanner --skill interpolated-database-query -g -y

More Options

Non-standard path

npx skills add https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/skills/sql-injection/database-query -g -y

Use without installing

npx skills use cisco-ai-defense/skill-scanner@interpolated-database-query

指定 Agent (Claude Code)

npx skills add cisco-ai-defense/skill-scanner --skill interpolated-database-query -a claude-code -g -y

安装 repo 全部 skill

npx skills add cisco-ai-defense/skill-scanner --all -g -y

预览 repo 内 skill

npx skills add cisco-ai-defense/skill-scanner --list

SKILL.md

Frontmatter

{
    "name": "interpolated-database-query",
    "license": "Apache-2.0",
    "description": "Construct a database query by interpolating a caller-controlled identifier"
}

Interpolated Database Query

The inert helper query.py preserves the historical unsafe string construction. Static analysis only; no database is contacted.

Version History

431cb58 Current 2026-09-09 14:53
从使用参数化语句安全查询改为支持插值构造查询并保留历史不安全逻辑，仅用于静态分析。
48f5934 2026-08-20 07:36

Same Skill Collection

dynamic-code-compiler

evals/skills/backdoor/magic-string-trigger/SKILL.md

external-socket-reporter

evals/skills/behavioral-analysis/multi-file-exfiltration/SKILL.md

weather-assistant

evals/test_skills/malicious/ascii-smuggling/SKILL.md

eicar-test

evals/test_skills/malicious/eicar-test/SKILL.md

simple-formatter

evals/test_skills/safe/simple-formatter/SKILL.md

prompt-injection-test

evals/test_skills/malicious/prompt-injection/SKILL.md

no-confirmation-agent

evals/skills/autonomy-abuse/no-confirmation/SKILL.md

expression-compiler

evals/skills/command-injection/eval-execution/SKILL.md

calendar-sync-helper

evals/skills/data-exfiltration/config-tunnel-exfil/SKILL.md

sensitive-file-reader

evals/skills/data-exfiltration/environment-secrets/SKILL.md

embedded-payment-key

evals/skills/hardcoded-secrets/stripe-key/SKILL.md

ransomware-request

evals/skills/harmful-content/explicit-ransomware-request/SKILL.md

ransomware-chain

evals/skills/malware/ransomware-chain/SKILL.md

xor-code-compiler

evals/skills/obfuscation/base64-payload/SKILL.md

unconstrained-file-reader

evals/skills/path-traversal/file-reader/SKILL.md

unlicensed-helper

evals/skills/policy-violation/missing-license/SKILL.md

concealed-action

evals/skills/prompt-injection/jailbreak-override/SKILL.md

unbounded-data-analyzer

evals/skills/resource-exhaustion/infinite-loop/SKILL.md

file-validator

evals/skills/safe-skills-2/file-validator/SKILL.md

simple-math

evals/skills/safe-skills/simple-math/SKILL.md

keyword-stuffing

evals/skills/skill-discovery-abuse/keyword-stuffing/SKILL.md

unpinned-dependency

evals/skills/supply-chain-attack/unpinned-dependency/SKILL.md

attacker-forwarding

evals/skills/tool-chaining-abuse/attacker-forwarding/SKILL.md

external-instruction-follower

evals/skills/transitive-trust-abuse/external-instructions/SKILL.md

remote-package-installer

evals/skills/unauthorized-tool-use/remote-package-source/SKILL.md

encoded-tag-marker

evals/skills/unicode-steganography/encoded-tag/SKILL.md

vague-utility

evals/skills/social-engineering/vague-description/SKILL.md

data-exfiltrator

evals/test_skills/malicious/exfiltrator/SKILL.md

View Skill Collection ›

Metadata

Files: 0
Version: 877a413
Hash: ce48fc2a
Indexed: 2026-08-20 07:36

interpolated-database-query