SQL Security

Use this when a project ships SQL through host code (MoonBit / TS / Rust / Go) and wants a cheap line of defence against the two recurring sources of SQL-domain incidents:

1. SQL injection: a string template that interpolates a value into a SQL fragment instead of binding it through a placeholder.
2. Secrets in queries: a hardcoded token or connection string that leaks into git history. Handled by secretlint, not this skill — see "Companion: secretlint" below.

sql-injection-scan.mjs

node scripts/sql-injection-scan.mjs your-project/src

The scanner walks the directory, ignores generated files (db/gen/, sqlc_*.mbt, *.test.mbt, _build/, dist/, target/), and flags:

• template-interp: a backtick string literal that starts with a SQL keyword (SELECT, INSERT INTO, WHERE, AND (, ...) AND contains a ${...} placeholder. Example: `WHERE c.vector_id IN (${placeholders})`.
• string-concat: a quoted SQL string adjacent to a + and an identifier. Example: "SELECT * FROM " + table.

The keyword match is case-sensitive on purpose — from / where / join appear constantly in English prose and would generate hundreds of false positives if matched case-insensitively.