injection
Detects SQL, command, and template injection caused by user input reaching an interpreter without parameterization. Use when writing code that constructs database queries, builds SQL strings, executes shell commands, processes templates with user input, evaluates code dynamically, or passes user- controlled data to any external interpreter.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/injection" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/injection ~/.claude/skills/injectionFrom README
Injection Security Check (A05:2025) What this checks Protects against SQL, command, and template injection caused by passing user-controlled data to an interpreter without sanitization. Exploitation leads to full database read/write, remote code execution, and data exfiltration. For NoSQL-specific injection (MongoDB operator injection, $where), see nosql-injection.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...