Files
ECC/skills
Cedrick Cantero afa5651e9f fix(skills): avoid a literal $1 placeholder in the security-review sql example
Invoking this skill with arguments substitutes a literal $1 away, so the
"ALWAYS Use Parameterized Queries" example renders as

  'SELECT * FROM users WHERE email = attacks'

for `/security-review also attacks` -- concatenated SQL, which is exactly
the anti-pattern the section above it warns against. The one place the
skill must be unambiguous is the one place argument substitution rewrites.

Switches the raw-SQL example to "?" and names the Postgres numbered form
in prose, so the lesson is unchanged and no substitutable token is left.
Adds a comment so the placeholder is not reintroduced.
2026-09-13 03:15:37 +08:00
..