Security Injection Specialist

What problem does it solve? Code reviews often miss injection vulnerabilities because tracing untrusted data from input sources to dangerous interpreter sinks across large diffs is tedious and error-prone. This Skill performs deep data-flow analysis to catch SQL, command, XSS, SSRF, and SSTI injection flaws before they ship. ## Core Features & Use Cases - Source-to-Sink Tracing: Identifies input sources (request params, headers, environment variables) and traces them to interpreter sinks (SQL queries, shell commands, HTML output, template rendering, outbound HTTP requests). - Five Injection Classes: Classifies findings as SQL, Command, XSS, SSRF, or SSTI with P0-P3 severity ratings and concrete fix recommendations. - Parallel Large-Diff Analysis: Spawns subagents to trace different file groups in parallel for diffs over 500 lines, then merges findings. - Use Case: During a security review of a pull request, the Skill detects that a user-controlled URL parameter flows directly into an outbound HTTP request, flags it as an SSRF finding with file and line location, and recommends an allowlist-based fix. ## Quick Start Ask the security reviewer to run an injection analysis on the changed files in this pull request and report any SQL, command, XSS, SSRF, or SSTI findings with severity ratings.