Skills
skills/wgpsec/aboutsecurity/sql-injection-methodology/Gen Agent Trust Hub

sql-injection-methodology

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted data from external target server responses, which presents an indirect prompt injection surface. \n
  • Ingestion points: Data from target responses is ingested via the http_request tool and through target responses processed by Python scripts in references/blind-injection.md and references/union-and-error.md. \n
  • Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to ignore instructions embedded in target responses. \n
  • Capability inventory: The skill utilizes python3 for script execution and has the capability to perform network operations and shell command execution (sqlmap). \n
  • Sanitization: Absent. Data retrieved from target servers (e.g., error messages or page content) is parsed via regex or string matching and used for data assembly without specific sanitization.
  • [COMMAND_EXECUTION]: The skill provides instructions and templates for executing security tools and custom scripts to automate testing. \n
  • Evidence: AGENT.md and references/waf-bypass-sqlmap.md instruct the agent to use sqlmap and local Python scripts to automate data extraction tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 10:08 AM