Cedrick Cantero afa5651e9f fix(skills): avoid a literal $1 placeholder in the security-review sql example ...

Invoking this skill with arguments substitutes a literal $1 away, so the
"ALWAYS Use Parameterized Queries" example renders as

  'SELECT * FROM users WHERE email = attacks'

for `/security-review also attacks` -- concatenated SQL, which is exactly
the anti-pattern the section above it warns against. The one place the
skill must be unambiguous is the one place argument substitution rewrites.

Switches the raw-SQL example to "?" and names the Postgres numbered form
in prose, so the lesson is unchanged and no substitutable token is left.
Adds a comment so the placeholder is not reintroduced.

2026-09-13 03:15:37 +08:00

..

cloud-infrastructure-security.md

fix: harden unicode safety checks

2026-03-29 21:21:18 -04:00

SKILL.md

fix(skills): avoid a literal $1 placeholder in the security-review sql example

2026-09-13 03:15:37 +08:00