T06 · System Persistence
Warning
- Location
INSTALL-UBUNTU.md:40- Finding
MongoDB Is Registered as a Persistent Boot-Time Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Mongo Db Client Tool
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate MongoDB helper, but it needs review because it handles database credentials with weak local-file guidance and recommends persistent system service setup.
Install only if you are comfortable giving the skill access to the configured MongoDB account. Prefer environment variables or a secret manager over config.json, use a dedicated least-privilege database user, pin dependencies before setup, and avoid enabling mongod at boot unless you need a persistent local server and have checked local binding, authentication, and firewall settings.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:24- Finding
Unpinned Python Dependencies Are Installed from a Mutable Package Index
- Content
View full analysis
Installing dependencies" "$VENV_DIR/bin/pip" install --quiet --upgrade pip "$VENV_DIR/bin/pip" install --quiet pymongo ``` ### Technical Analysis The setup process upgrades `pip` and installs `pymongo` without pinning reviewed versions or verifying package hashes. Consequently, the actual executable dependency set can change every time setup is run. Although `pymongo` is the legitimate package name and no typosquatting or suspicious package source was identified, resolving the latest available versions from a mutable package index creates a supply-chain risk. A compromised release, index account, mirror, or transitive dependency could introduce code that was not present during this audit. Python packages may execute code during installation, and imported package code executes with the permissions of the user running the MongoDB client. ### Attack Path 1. An attacker compromises a relevant package release, package-index account, distribution path, or dependency. 2. A user runs `scripts/setup.sh`. 3. `pip` resolves the current unpinned versions rather than a previously reviewed dependency set. 4. The compromised package is downloaded and installed into `scripts/.venv`. 5. Malicious installation logic executes immediately, or malicious runtime logic executes when `mongo_client.py` imports `pymongo`. 6. The payload gains the setup or client process's user privileges and can access resources available to that account. ### Impact Assessment Successful exploitation would provide arbitrary code execution with the privileges of the account running setup or the database client. This can expose environment variables, MongoDB connection credentials, readable workspace files, and any database permissions associated with the configured account. The setup script itself ...[truncated 230 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Plaintext Credential Configuration Is Recommended Without the Claimed Git Ignore Protection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \ sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor # Add MongoDB repo for your Ubuntu version (e.g. 24.04) echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \ sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor # Add MongoDB repo for your Ubuntu version (e.g. 24.04) echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install prerequisites sudo apt-get install -y gnupg curl # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 75% confidence
- Finding
The command pipes data fetched over the network directly into a privileged gpg process writing to a system keyring path. Although this is a common setup pattern, it creates a supply-chain risk because compromised transport, DNS, or upstream content could result in trusting an attacker-controlled repository signing key.
- Content
md # Import MongoDB public GPG key curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | \ sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor # Add MongoDB repo for your Ubuntu version (e.g. 24.04) echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash sudo systemctl start mongod sudo systemctl enable mongod
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Action | Command | |----------|----------------------------------| | Start | `sudo systemctl start mongod` | | Stop | `sudo systemctl stop mongod` | | Restart | `sudo systemctl restart mongod` | | Status | `sudo systemctl status mongod` |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Action | Command | |----------|----------------------------------| | Start | `sudo systemctl start mongod` | | Stop | `sudo systemctl stop mongod` | | Restart | `sudo systemctl restart mongod` | | Status | `sudo systemctl status mongod` |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Action | Command | |----------|----------------------------------| | Start | `sudo systemctl start mongod` | | Stop | `sudo systemctl stop mongod` | | Restart | `sudo systemctl restart mongod` | | Status | `sudo systemctl status mongod` |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Action | Command | |----------|----------------------------------| | Start | `sudo systemctl start mongod` | | Stop | `sudo systemctl stop mongod` | | Restart | `sudo systemctl restart mongod` | | Status | `sudo systemctl status mongod` |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill exposes access to environment-derived database credentials and encourages execution of a Python client, but it declares no explicit tool scope or permission boundary. In an agent ecosystem, that can let the skill be invoked with broader-than-intended access to secrets or runtime capabilities, increasing the chance of unauthorized database actions or credential misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation guidance is broad enough to match generic requests like "save to the database" or persistence across sessions, which may cause an orchestrator to route unrelated or sensitive data into MongoDB without strong user intent. That increases the risk of over-collection, accidental persistence of secrets, or use of this skill when a narrower storage mechanism would be safer.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## When to use - User asks to "save to the database", "store this in Mongo", "retrieve from MongoDB" - An agent needs to persist data across sessions (budgets, transactions, summaries, watchlists) - An agent needs to query, filter, or aggregate stored records - A new collection or schema (validator) needs to be set up
Static analysis
No suspicious patterns detected.