SQL injection

Why this agent matters

Injection is one of the oldest bug classes and still one of the most damaging: a single injectable query can expose or rewrite an entire database. It sits under OWASP Top 10 A03 (Injection) and CWE-89 is a fixture of the CWE Top 25.

It is also one of the noisiest for scanners. Pattern rules flag every string-built query, including ones built from constants or already-bound parameters. This agent traces whether the value is really user-controlled and whether it is bound before the sink, so your team stops re-reviewing safe ORM code.

What it checks

• Queries built with f-strings, concatenation or .format()
• ORM escape hatches used unsafely — text(), raw(), execute() with interpolated values
• Dynamic table or column names taken from input
• NoSQL / Hibernate query construction from request data

When it marks a finding as a likely false positive

• The value is bound as a query parameter before execution
• The interpolated value is a constant or comes from server-side config

The fix it suggests

• Parameterized / prepared statements or the ORM's safe query API
• An allow-list for dynamic identifiers that cannot be bound
• Never ad-hoc escaping

Scope and limits

This agent validates findings reported by Semgrep, Gitleaks and Trivy; it doesn't hunt for new bugs on its own. A finding reaches it when its CWE or rule/path keywords match this vulnerability class. It sees only the minimal code around the finding, with secrets redacted, and returns a verdict with a confidence score, a plain-English explanation and a suggested patch.

Common questions

Related agents

• Cross-site scripting (XSS) — Checks whether untrusted data is rendered into HTML or JavaScript without contextual encoding.
• Server-side request forgery (SSRF) — Checks whether a server-side request can be pointed at a host the attacker chooses.
• Command & code injection — Checks whether user input reaches a shell, eval or template-evaluation sink.

See all 20 review agents → · Agent setup reviewer · How the pipeline works