The Agent Skills Directory

[DYNAMIC_EXECUTION]: The DatabaseManager.cs template in templates/database-manager.cs contains a SQL injection vulnerability in the SeedProductAsync method. It uses string interpolation to build a SQL query ($"INSERT INTO products ... VALUES ('{id}', '{name}', {price}, ...)") using the name parameter directly. An attacker providing a malicious string for the product name could execute arbitrary SQL commands against the test database.
[DYNAMIC_EXECUTION]: The DatabaseManager.cs implementation dynamically loads and executes SQL scripts from the file system within the EnsureTablesExistAsync method. It reads files from a SqlScripts directory relative to the application's base directory and executes them using NpgsqlCommand. This creates a dependency on the integrity of the local file system where a compromised script file would result in arbitrary database command execution.

dotnet-testing-advanced-webapi-integration-testing