SQL Injection Finder

What this skill does

Static-scans a codebase for SQL queries built via string concatenation or template interpolation, flags each occurrence, and proposes a parameterized rewrite using the project's existing driver API.

Inputs

• repo_dir: project root.
• language: one of python, node, go, java, php.
• Optional driver: hint about the SQL client in use (e.g., psycopg2, pg, database/sql).

Steps

1. Detect SQL keywords concatenated with variables. Run language-tuned ripgrep patterns:
   • Python: rg -nN '(execute|executemany|query)\s*\(\s*["\x27].*?(\+|%|\.format|f["\x27])' --type py.
   • Node: rg -nN '(query|execute)\s*\(\s*[\x60"\x27].*?\$\{|\+\s*\w+' --type js --type ts.
   • Go: rg -nN 'fmt\.Sprintf\(.*(SELECT|INSERT|UPDATE|DELETE)' --type go.
   • Java: rg -nN '(prepareStatement|createStatement).*\+\s*\w+'.
   • PHP: rg -nN '(mysql_query|mysqli_query|->query)\(.*"\..*"'.
2. Filter false positives: detect ? placeholders or named params nearby; if every variable interpolation is a parameter binding, skip.
3. Run a deeper Semgrep scan: semgrep --config=p/sqli <repo_dir>.
4. Merge results from ripgrep and Semgrep, deduplicating by file:line.
5. For each finding, extract the surrounding 5 lines.
6. Rewrite suggestion per driver: psycopg2 -> cursor.execute("... %s ...", (val,)); pg (Node) -> client.query('... $1 ...', [val]); database/sql (Go) -> db.Query("... ? ...", val).
7. Tag each finding with severity: high if user input flows in (look for req.body, request.args, os.Args); medium for internal calls.
8. Write a report grouped by severity.

Output

sqli-audit.md with summary counts and a per-finding section showing the snippet, the rewrite, and severity. Plus a JSON sidecar sqli-audit.json for tooling. Exit 1 if any high-severity finding remains.

Verification

Compile or parse the rewritten snippets in isolation (a small python -c or node -e per snippet) to confirm syntactic validity. Re-run Semgrep after the rewrites are applied and confirm zero sqli rule hits. Sample three findings and trace the variable's origin manually; if the variable is a literal constant the severity should drop to info, not high.

Edge cases

• Dynamic table or column names (which legitimately can't be parameterized): suggest an allowlist check rather than parameterization; never silently drop the finding.
• ORMs that already parameterize (SQLAlchemy text(...), Sequelize): tune the regex to skip the ORM's safe wrappers.
• Stored procedures called via CALL: still flag concatenation in the call site.
• Generated migration SQL: skip files under migrations/ by default but expose via a flag.