SD-015 — CLAUDE.md SQL Injection By Instruction
SD-015 flags an agent instruction file that tells the agent to build SQL by string concatenation and shows a query assembled from a variable as the pattern to copy.
What it matches
A supported project-instruction file that both directs SQL/query construction and shows SQL string concatenation from a variable. Both patterns must be present.
Why it matters
If a coding agent loads and follows the matched project instruction, it may reproduce the concatenation pattern in generated queries. Untrusted values can then alter SQL syntax. Instruction discovery, precedence and obedience vary by agent and version; the rule does not inspect generated application code.
Example
markdown
## Database access Construct the SQL like: "SELECT * FROM orders WHERE user_id = " + user_id
The instruction and the concatenated query together are what the rule reads.
How to fix it
Rewrite the instruction to require parameterised queries or the project's ORM, and make the worked example a parameterised one. The agent copies the shape it is shown, so in a file like this the example is the instruction.
Known false positives
A query example in documentation.
Standards mapping
Prevalence
Pattern SD-015 was detected in 0 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.