Mongodb Connector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed MongoDB connector, but it gives agents broad database-changing and administrative authority with weak scoping around destructive actions and live remote instructions.

Install only if you trust AgentPMT and can restrict the connected MongoDB account and platform permissions to the minimum needed. Avoid granting delete or admin permissions for production data unless you require them, review live instructions before acting on them, and treat exports as sensitive files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:289
• Finding: Unpinned Third-Party Skill Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 289-305 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown If those setup skills are not installed beside this product skill, use the downloads below. Core AgentPMT setup skills: - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup ``` ``` ### Technical Analysis The documented setup process invokes `npx` and installs skills from mutable external sources without specifying an immutable package version, repository commit, checksum, or signature. Consequently, the content installed when a user follows these instructions may differ from the content available when this Skill was audited. Because the referenced setup skill handles account and API connection details, a compromised dependency could provide malicious credential-handling instructions or introduce unsafe executable behavior. The project does not instruct users to inspect or verify the downloaded content before activating it. This is a supply-chain weakness rather than evidence that the currently referenced dependencies are malicious. ### Attack Path 1. An attacker compromises the upstream package, repository, publishing account, distribution ...[truncated 1210 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an immutable package version and repository commit. 2. Publish cryptographic checksums or signed release manifests and verify them before installation. 3. Avoid floating repository references and implicit latest-version resolution. 4. Use a trusted registry with package provenance and signature verification enabled. 5. Require the downloaded skill content to be reviewed before it is activated. 6. Run installation in a restricted environment with minimal filesystem, network, and credential access. 7. Document the expected dependency hashes and provide a process for securely updating them. 8. Prefer locally bundled, audited setup documentation when feasible. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:226
• Finding: Mutable Remote Instructions Can Override the Audited Local Specification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 226-230 **Vulnerability Type**: Remote instruction trust and behavioral override **Risk Level**: Medium ### Vulnerable Code ```markdown ## Live Schema And Examples Use the compact schema above for ordinary calls. Before a new production integration, or whenever parameters, enum values, nested objects, outputs, or examples are unclear, fetch live details first. - Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "mongodb-connector"`. - Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "mongodb-connector"`, or call this product with `action: "get_instructions"` when the product tool is already selected. - Treat returned live schema and instructions as more specific than this generated summary. ``` ### Technical Analysis The Skill directs the agent to retrieve instructions from a remote service and treat the returned material as more specific than the locally stored and audited summary. This creates a mutable instruction channel whose effective behavior can change without modifying the Skill package. The retrieved content is not constrained to a pinned version, cryptographically authenticated policy document, or locally defined action allowlist. The Skill also does not explicitly state that remote instructions are untrusted data that must not override system policies, user intent, permission boundaries, or confirmation requirements. This finding does not establish that AgentPMT currently returns malicious instructions. The risk arises because compromise or misconfiguration of the remote instruction source could alter agent behavior after local review. ### Attack Path 1. An attacker compromises the remote instruction service, its publishing account, or an upstream system responsible for `get_instructions` responses. 2. Alternatively, an authorized but erroneous update introduces u ...[truncated 1147 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all remotely returned schema, examples, and instructions as untrusted data. 2. Remove the statement that remote instructions automatically supersede the audited local summary. 3. Pin remote instruction documents to a version or cryptographic digest and verify their signatures. 4. Validate every requested action and parameter against a local schema and explicit action allowlist. 5. Prohibit remote content from overriding system policies, user intent, platform permissions, credential-handling rules, or confirmation requirements. 6. Require explicit user confirmation for exports, bulk writes, broad updates or deletions, collection and index drops, aggregation stages such as `$out` or `$merge`, and arbitrary `run_command` operations. 7. Reject remote instructions that request unrelated tools, credentials, local command execution, or additional network destinations. 8. Log the verified remote instruction version and any differences from the local specification for review. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Ae1

High

• Category: analysis-evasion

Content

Complete generated action schema: `./schema.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The schema explicitly exposes a `run_command` action that accepts any MongoDB command document, which bypasses the narrower 'permission-gated' framing in the skill description and enables administrative or destructive operations well beyond simple querying and export. In a remote tool context, this materially expands the attack surface to include data destruction, metadata disclosure, privilege abuse, and denial-of-service depending on the connected account's database privileges.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promotes export-to-CSV/JSON features but does not clearly warn that exported query results may contain sensitive records and may be written to downloadable files outside the original database controls. In this context, the tool is specifically designed to access user databases, so omission of an export sensitivity warning increases the likelihood of unintended data exposure through files and downstream handling.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill promotes export-to-CSV/JSON features but does not clearly warn that exported query results may contain sensitive records and may be written to downloadable files outside the original database controls. In this context, the tool is specifically designed to access user databases, so omission of an export sensitivity warning increases the likelihood of unintended data exposure through files and downstream handling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/mongodb-connector
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/mongodb-connector
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This markdown schema lists `bulk_write` as supporting delete and replace operations, which can permanently modify or remove data, but it provides no warning or cautionary note for users. Under the markdown-specific warning rule, destructive behaviours that can affect user data should be disclosed clearly in the skill description.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The `delete_documents` action explicitly deletes one or many documents and even supports deleting all matches, but the description contains no warning about permanence or accidental broad deletion. For markdown skill descriptions, destructive operations affecting user data should include a user-facing caution.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The `drop_collection` action removes an entire collection, which is a destructive and potentially irreversible operation, yet the documentation presents it without any caution. Users should be warned when a skill can affect system integrity or permanently destroy stored data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `find_one_and_delete` action atomically deletes a document and returns it, but the schema text does not warn that the matched record will be removed from the database. This is a data-affecting behaviour that should be disclosed in markdown documentation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The schema describes unrestricted database command execution and provides no warning or limitation on potentially destructive commands. In this connector context, that omission is more dangerous because agents may treat schema-described actions as routine and invoke commands that alter state, expose sensitive metadata, or disrupt service if the connected identity has sufficient privileges.

Static analysis

No suspicious patterns detected.