What types of injections can this skill detect?

It detects a wide range of vulnerabilities including SQL, NoSQL, OS Command, LDAP, Expression Language, and ORM injections.

How does the 'deep' depth setting work?

The deep analysis traces user input from HTTP entry points through complex call chains across multiple files to find hidden security sinks.

Which programming languages are supported?

It supports major languages including Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, C#, Rust, and more.

Can I integrate it with my existing security scanners?

Absolutely. It integrates with and normalizes output from tools like Semgrep, Bandit, Gosec, Brakeman, and SpotBugs.

Does it support automated fixes?

Yes, using the --fix flag, the skill can generate parameterized replacements and safe code patterns to remediate identified vulnerabilities.

Injection Security Analysis

Name: Injection Security Analysis
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Audits source code for SQL, NoSQL, and command injection vulnerabilities to align with OWASP Top 10 security standards.

The Injection Security Analysis skill empowers Claude to identify and mitigate critical security flaws where untrusted data flows into sensitive interpreters. By mapping directly to OWASP A03:2021, it scans for patterns across SQL queries, OS commands, LDAP operations, and ORM usage. It integrates with industry-standard scanners like Semgrep and Bandit to provide deep data-flow analysis, taint tracking, and automated remediation suggestions, ensuring your codebase remains resilient against tampering and unauthorized access.

Key Features

01Seamless integration with security tools like Semgrep, Bandit, and Gosec

02Flexible scanning depths ranging from quick pattern matching to expert-level red team simulations

03Multi-vector injection detection including SQL, NoSQL, LDAP, and OS commands

046 GitHub stars

05Deep data-flow and taint analysis to trace user input from source to sink

06Automated fix generation for replacing vulnerable code with parameterized alternatives

Use Cases

01Remediating legacy codebases containing string-concatenated SQL queries

02Performing automated security audits during CI/CD or before code merges

03Validating that user-supplied input is properly sanitized before reaching system shells or databases

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code injection

For use in Claude.ai and ChatGPT

Download Skill