If anyone is interested in how it works, here's the whole thing (I'm looking for strings inside a call to a text function, which is how you wrap sql for sqlalchemy).

    # queries/python/injections.scm
    ; inherits: python
    
    ((call
      function: (identifier) @_func
      arguments: (argument_list (string) @sql))
    (#eq? @_func "text"))

There's a little nuance here where the thing that treesitter parses includes the """ (or ") at the start / end but because it can recovery from errors I'm not bothering with wrangling the offsets.