Trust Assessment
sql-query-builder received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, SQL Injection via Unsanitized Table/Column Names and Identifiers, SQL Injection in LIKE clause with unescaped wildcards.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | SQL Injection via Unsanitized Table/Column Names and Identifiers The SQL query builder directly concatenates string inputs for SQL identifiers such as table names, column names, aliases, and GROUP BY clauses without proper validation or escaping. If these string inputs are derived from untrusted user input, an attacker can inject arbitrary SQL commands, leading to data manipulation, unauthorized access, or denial of service. While the `_format_value` method attempts to quote string *values*, it does not protect against injection in structural elements of the query. Implement strict whitelisting for all table names, column names, and other SQL identifiers against a predefined schema (e.g., `self.schemas`). Alternatively, use database-specific identifier quoting (e.g., `"table_name"` for PostgreSQL) for all such inputs. Ensure that all structural components of the SQL query are either hardcoded, whitelisted, or properly escaped/quoted, rather than directly concatenated from potentially untrusted input. | LLM | SKILL.md:204 | |
| HIGH | SQL Injection in LIKE clause with unescaped wildcards The `WhereCondition.to_sql()` method directly inserts the `self.value` into a `LIKE` clause without escaping SQL wildcards (`%`, `_`) or the single quote character. If `self.value` is user-controlled, an attacker can use these characters to broaden the search, bypass intended filters, or inject SQL. When using `LIKE`, ensure that any user-provided `self.value` is properly escaped for SQL wildcards (`%`, `_`) and single quotes before being embedded in the query string. For example, replace `'` with `''`, `_` with `\_`, and `%` with `\%` (depending on the database dialect's escape character). | LLM | SKILL.md:56 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/sql-query-builder/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/48d79db6c4baf604)
Powered by SkillShield