One main thing which you have pointed out is SQL Injection. This is one thing which a few people I've seen seem to miss completely and start developing using non Joomla coding standards and start writing SQL queires using
Second thing which I kind of mentioned in the first point, which is always stick to Joomla coding standards. The only time you shouldn't is when Joomla does not provide an alternative.
Thirdly, if you're extension creates a folder or file, then ensure you give them the correct permissions and do not start making folder chmod 777. This is the exact reason why K2 which is one of the most popular extensions out there was considered vulnerable and removed from JED temporarily.
Always use tokens with forms. This will ensure that no unauthorized attacks from other sites can be executed. For more information regarding this, have a look at the following:
If you're unsure of something having already run some tests, try popping along to the Code Review Stackexchange as there might be someone willing to check over your code for you.
One thing you can do is have a look at the Vulnerable Extensions List to see the extensions that have temporarily (until fixed) been removed from the Joomla Extensions Directory due to not being safe.
Hope this gives you a little insight and good luck with your first extension