What problem does it solve? Security reviewers and developers need a systematic way to find injection vulnerabilities during code audits, but manually tracing every path from user input to dangerous sinks across multiple languages and frameworks is slow and error-prone. ## Core Features & Use Cases - Multi-Language Search Patterns: Ready-to-use grep patterns for Python, JavaScript, TypeScript, Java, Ruby, PHP, and template engines to locate dangerous sinks like raw SQL, shell execution, and unescaped template rendering. - Six Injection Classes Covered: SQL injection (including ORM bypasses and NoSQL), XSS (reflected, stored, DOM-based), SSTI, command injection, SSRF, and path traversal, each with vulnerable and secure code examples. - Source-to-Sink Verification Workflow: A checklist for tracing untrusted input to sensitive sinks, evaluating sanitization, and assessing real-world exploitability. - Use Case: During a security review of a Node.js API, run the provided grep patterns to find exec() calls and sequelize.query() with template literals, then trace whether req.query or req.body values reach them without sanitization. ## Quick Start Ask the agent to scan this repository for SQL injection and command injection vulnerabilities using the injection pattern detection workflow.
