no-fstring-sql-interpolation
Do not build SQL by interpolating values with f-strings, .format(), or +.
Skill by StopThatSlop
Chalk Labs
Need help deploying no-fstring-sql-interpolation?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/stopthatslop-no-fstring-sql-interpolation
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: backend, writing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md and code. Checked Nov 1, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/no-fstring-sql-interpolation
What's inside
- Skill name
no-fstring-sql-interpolation- Description
- Do not build SQL by interpolating values with f-strings, .format(), or +. Use bound parameters. Use only when editing Python code that composes SQL or Cypher queries. Do not use for ORM query builders, identifiers assembled from a trusted allowlist, or non-SQL string templates.
- License
- MIT
- Metadata
- pack: stopthatslop-python-fastapi-v1 · globs: **/*.py · engine_rule_id: python.sql.no-fstring-sql-interpolation
- Instructions
- 36 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
SKILL.md (first lines)
# No f-string SQL interpolation
Interpolated values are an injection surface and a plan-cache killer. Agents
write `f"... WHERE email = '{email}'"` because it reads nicely. Bound
parameters read nearly as well and are safe.
## Do
```python
def find_user(conn, email: str) -> dict | None:
row = conn.execute(
"SELECT id, email FROM users WHERE email = %s",
(email,),
).fetchone()
return dict(row) if row else None
```
## Do not
```python
def find_user(conn, email: str) -> dict | None:
row = conn.execute(
f"SELECT id, email FROM users WHERE email = '{email}'"
).fetchone()
return dict(row) if row else None
```
The same rule covers `.format()`, `%` formatting, and string concatenation of
user-controlled values into any query text.
## Enforce
This skill is teach-only. No engine detector exists yet; CI must not fail on
it.From StopThatSlop/stopthatslop, MIT.
More from StopThatSlop/stopthatslop
- 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-to-many-fetch
StopThatSlop
Do not map OneToMany/ManyToMany as FetchType.EAGER.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fetch-without-abort-timeout
StopThatSlop
Do not call fetch without an abort signal timeout.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-file-upload-without-validation
StopThatSlop
Do not accept MultipartFile/Part without size, type, or name checks.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-go-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with fmt.Sprintf or concatenation.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-detached-goroutine
StopThatSlop
Do not start a goroutine from an HTTP handler without a context from the request.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-direct-outbound-http
StopThatSlop
Do not call http.Get/Post/Head or client.Do from an HTTP handler.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-direct-sql-execution
StopThatSlop
Do not call Query/Exec/Begin from an HTTP handler.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-handler-rooted-background-context
StopThatSlop
Do not pass context.Background() from an HTTP handler.
SkillBFreshness: B★ 4Claude Code +9
Signals
- Stars
- 4
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Sep 1, 2026 (2 months ago)
- Last release
- Sep 13, 2026 (1 month ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- Repository
- github.com/StopThatSlop/stopthatslop
- Website
- stopthatslop.com
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from StopThatSlop
- 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-controller-direct-repository-access
StopThatSlop
Do not inject a *Repository or *Dao into a @Controller/@RestController.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with f-strings, format, or concatenation.
SkillBFreshness: B★ 4Claude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get no-fstring-sql-interpolation running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
no-fstring-sql-interpolation skill. Agent Mart. https://agentmart.dev/skills/stopthatslop-no-fstring-sql-interpolation (last updated 2026-10-24)