exploiting-sql-injection-with-sqlmap

SUSPICIOUS. The install path is mostly benign and consistent with sqlmap’s official ecosystem, but the skill’s actual purpose is to give an AI agent offensive exploitation capability: confirming SQL injection, extracting database contents, bypassing WAFs, reading server files, and executing OS commands. That footprint is inherently high risk for an agent skill even when framed as authorized testing.

The code is an explicit sqlmap automation and penetration-testing wrapper. It performs active scans and can enumerate or dump database contents, so it should only be used against authorized targets. Arguments are passed without shell interpolation, and no covert exfiltration, persistence, credential theft, or other malware indicators are present. Main risks are execution of a potentially PATH-hijacked sqlmap binary, unrestricted report-file overwrite, and exposure of retrieved database data. The apparent incomplete `main(` call may make the supplied fragment syntactically invalid.