Report Sql

This skill is a detailed design document for a SQL templating protocol — it does not include an implementation. It does not request credentials or install anything, so there's no direct exfiltration risk from the package itself. However, the SKILL.md repeatedly claims the templates are 'safe' and 'injection-proof' but offers no runtime or enforcement code. Before using this in production, do the following: 1) Confirm the actual template engine or code that will render these templates implements parameter binding or proper escaping (do not rely on string concatenation). 2) Request example implementation code or tests from the author that prove block-removal semantics and escaping behavior (including edge cases and malicious inputs). 3) Run unit tests with attacker-controlled inputs to verify no SQL injection and that empty/partial blocks are removed safely. 4) Prefer parameterized queries (driver-level placeholders) over textual substitution where possible. 5) Review how the system logs queries and variables to avoid leaking PII/credentials. If you cannot obtain an implementation or confident tests, treat these instructions as a spec only and do not assume they protect you from injection.