ClawHub
Back to skill

Security audit

MongoDB Atlas

Security checks for vulnerabilities and agentic risk

Overview

This MongoDB Atlas skill is coherent, but it needs Review because it can use powerful Atlas credentials while sending them to a configurable API host and caching tokens in plaintext.

Install only if you are comfortable giving the skill Atlas Admin API authority through your service account. Use a least-privilege service account, leave ATLAS_API_BASE_URL unset or set it only to https://cloud.mongodb.com, review dry-runs before any state-changing call, and treat the local token cache as sensitive credential material.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/atlas-call.mjs:65
Finding

Atlas credentials and bearer tokens can be transmitted to an arbitrary or plaintext origin

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/atlas-call.mjs:49
Finding

OAuth bearer token is persisted in plaintext without explicit restrictive permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · resources/atlas-admin-api-v2-openapi-source.json (reported line 1)May include surrounding context.

json
very document URL.","type":"string"},"oktaIdpId":{"description":"Legacy 20-hexadecimal digit string that identifies the identity provider.","pattern":"^([a-f0-9]{20})$","type":"string"},"pemFileInfo":{"$ref":"#/components/schemas/PemFileInfo"},"protocol":{"description":"String enum that indicates the protocol of the identity provider. Either SAML or OIDC.","enum":["SAML","OIDC"],"type":"string"},"requestBinding":{"description":"SAML Authentication Request Protocol HTTP method binding (POST or REDIRECT) that Federated Authentication uses to send the authentication request.","enum":["HTTP-POST","HTTP-REDIRECT"],"type":"string"},"responseSignatureAlgorithm":{"description":"Signature algorithm that Federated Authentication uses to encrypt the identity provider signature.","enum":["SHA-1","SHA-256"],"type":"string"},"slug":{"description":"Custom SSO Url for the identity provider.","type":"string"},"ssoDebugEnabled":{"description":"Flag that indicates whether the identity provider has SSO de

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/atlas-call.mjs (reported line 66)May include surrounding context.

js
}
}

// Get access token (with caching)
async function getAccessToken() {
  const clientId = process.env.ATLAS_CLIENT_ID;
  const clientSecret = process.env.ATLAS_CLIENT_SECRET;

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/atlas-call.mjs (reported line 102)May include surrounding context.

js
}
}

// Get access token (with caching)
async function getAccessToken() {
  const clientId = process.env.ATLAS_CLIENT_ID;
  const clientSecret = process.env.ATLAS_CLIENT_SECRET;

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/atlas-call.mjs (reported line 110)May include surrounding context.

js
}
}

// Get access token (with caching)
async function getAccessToken() {
  const clientId = process.env.ATLAS_CLIENT_ID;
  const clientSecret = process.env.ATLAS_CLIENT_SECRET;

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares the ability to use environment-provided credentials and make live network/API calls, but it does not define any explicit tool scope such as permissions or allowed-tools. That creates a trust gap where an agent may expose or use sensitive Atlas credentials and perform external actions without clear, enforceable boundaries, increasing the risk of unintended destructive API operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The script includes a built-in bypass for the safety interlock on destructive operations via the --yes flag, allowing POST/PUT/DELETE/PATCH requests to execute non-interactively. In an agent skill context, this materially increases the chance of unintended or autonomous modification/deletion of Atlas resources if an upstream component or prompt induces use of the flag.

Content

Scanner excerpt · scripts/atlas-call.mjs (reported line 218)May include surrounding context.

js
-p, --params <json>    Query parameters (JSON string)
  -f, --file <path>      Read request body from JSON file
  --dry-run              Show what would be called without making the request
  --yes                  Skip confirmation for risky operations (NOT RECOMMENDED)

Environment:
  ATLAS_CLIENT_ID        Service Account Client ID (required)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This OpenAPI document repeatedly embeds documentation URLs with the /zh-cn/ locale, which hard-codes a specific language experience for users consuming the referenced docs. Because the file does not offer an alternative locale or indicate user opt-in, this is a natural-language locale policy issue rather than a code-security issue.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/atlas-call.mjs:68

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
scripts/atlas-call.mjs:34