Skills
Navigate
skills/0xghostcat/claude-ai-cyber-security-skills/sqli/Gen Agent Trust Hub

sqli

Warn

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the NoSQLMap tool from a third-party repository on GitHub (github.com/codingo/NoSQLMap).
  • [REMOTE_CODE_EXECUTION]: Instructions include executing the downloaded NoSQLMap.py script using the Python interpreter.
  • [COMMAND_EXECUTION]: The skill uses multiple system utilities such as sqlmap, ghauri, curl, jq, and git to conduct security assessments.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Untrusted data from external target servers is ingested via curl responses in SKILL.md. There are no boundary markers or sanitization procedures present to prevent the agent from interpreting malicious content in these responses as commands. Given the skill's capabilities for network access, file downloads, and script execution, this lack of isolation poses a security risk.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 11, 2026, 10:41 AM