Security audit

MongoDB

Security checks for vulnerabilities and agentic risk

Overview

This MongoDB skill is mostly coherent database-operations guidance, but it persistently stores potentially sensitive production database context in local plaintext memory without a clear opt-in, redaction, retention, or file-protection policy.

Review the memory behavior before installing. This skill may keep MongoDB deployment details, collection names, query patterns, incident history, and performance baselines under ~/Clawic/data/mongodb/; avoid storing secrets, connection strings, tenant/customer identifiers, or raw production data there, and consider tightening file permissions or clearing the memory file after sensitive work. Treat destructive database commands and profiler changes as production changes requiring explicit review.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: setup.md:11
Finding: Persistent plaintext storage of sensitive MongoDB operational metadata
Content: View full analysis
`profile.yaml` > table default. Work from defaults immediately. Never open with questions about their cluster, their priorities, or how proactive to be. ``` From `setup.md:31-33`: ```markdown ## What Memory Holds See `memory-template.md` for the file format. Track the shape of their deployment (standalone, replica set, sharded, Atlas tier), the collections and query patterns that keep coming up, incidents already diagnosed, and measured baselines for the metrics in `monitoring.md` — but only from what they actually reveal. ``` From `memory-template.md:1-27`: ```markdown # Memory Template — MongoDB Create `~/Clawic/data/mongodb/memory.md` with this structure: ```markdown # MongoDB Memory ## Status status: ongoing last: YYYY-MM-DD ## Deployment ## Data Shape
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · mongosh.md (reported line 57)May include surrounding context.

Preview before you mutate: run the filter as a countDocuments and a findOne first. updateMany with a wrong filter is not undoable.

Batch by range rather than one giant statement — the loop pattern lives in migrations.md.

db.coll.deleteMany({}) and db.dropDatabase() have no confirmation. When destructive_confirm is on (SKILL.md Configuration), emit the command for review instead of running it.

Verify a unique index will succeed before building it:

javascript

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read local profile, config, and memory files containing user preferences and prior context without any user-facing disclosure or consent step. Even if intended for convenience, this creates a privacy boundary violation because the agent may access unrelated or sensitive local data automatically on first use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to persist user preferences and contextual information to local config and memory files during normal operation, again without explicit user notice. This is dangerous because users may unknowingly cause durable storage of operational details, preferences, or environment metadata that could later be exposed to other skills, users, or processes on the same system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Line L09 directs the reader to enable profiling, which records database operations and can capture query details. Although the file discusses performance usage, it does not warn users here about the privacy/operational impact of collecting profiler data, which is a user/system-affecting behavior for markdown guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions say to turn profiling off, drop system.profile, and recreate it larger, but do not explicitly warn that dropping the collection irreversibly deletes existing profiler history. In a production troubleshooting context, an operator could follow this literally and destroy forensic or performance evidence needed for incident response, troubleshooting, or audit review.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.