What problem does it solve? Static scanners flag SQL injection candidates but cannot prove they are actually exploitable, leaving teams unsure which findings are real. This Skill dynamically confirms exploitability by firing real SQLi payloads at running local or staging targets, producing evidence-backed verdicts. ## Core Features & Use Cases - Multi-technique confirmation: Sequentially attempts Error-based, Boolean-based Blind (noise-floor calibrated), and Time-based Blind detection, with automatic sqlmap integration when installed and a manual PoC fallback when it is not. - Fail-closed safety gate: Every launch passes through scope_guard, which blocks production-like hosts (www.*, prod, public IPs) at the code level and only permits localhost, loopback, or explicitly allowlisted staging targets. - Evidence-based reporting: Generates a four-element report (vulnerable point, root cause, exploitation method, fix) with actual requests, responses, and timing data attached as JSON evidence. - Use Case: After a static scan flags a MyBatis ${} binding in BoardMapper.xml, run this Skill against the corresponding staging endpoint to confirm a Time-based Blind SQLi via pg_sleep and attach the measured delay evidence to the remediation ticket. ## Quick Start Ask the AI to verify whether the SQL injection candidate found by the static scan is actually exploitable against http://localhost:8080/board?id=1 using the id parameter.
