mongodb-query

Query MongoDB databases for debugging and troubleshooting. Use when user needs to: (1) List all databases, (2) List collections in a database, (3) Execute Mo...

Security Scan

The skill appears to do what it says (query MongoDB) but has mismatches and risky guidance — it uses kubectl and asks for full DB credentials yet those requirements aren't declared, and it recommends persisting secrets in project files.

Purpose & Capability

The script's functionality (listing DBs/collections, running queries, optionally port-forwarding a Kubernetes service) matches the skill name/description. However registry metadata claimed no required binaries or credentials while SKILL.md and the script require Python/pymongo and optionally kubectl. The omission of kubectl/pymongo from declared requirements is an inconsistency.

Instruction Scope

SKILL.md correctly instructs the agent to ask the user for a full MongoDB URI (including credentials). It also recommends saving connection info into a project's TOOLS.md — instructing persistent storage of credentials in a repo is scope creep and increases risk of credential leakage. The instructions also rely on kubectl port-forward (which interacts with the user's kubeconfig) but this is not emphasized as a sensitive operation.

Install Mechanism

No install spec is provided (instruction-only), which reduces install-surface risk. The SKILL.md does require installing pymongo via pip, and the script will invoke kubectl if needed. The lack of an explicit install spec or dependency declaration in registry metadata is a mismatch but not itself malicious.

Credentials

The skill asks for full MongoDB connection URIs (username/password embedded) — that is expected for DB queries but is sensitive. It also will call kubectl which implicitly uses the user's kubeconfig and cluster credentials; SKILL.md does not declare or warn about kubeconfig access. Recommending storing the URI in TOOLS.md is disproportionate and dangerous.

Persistence & Privilege

The skill does not request always:true, does not modify other skills' configs, and the code does not persist changes itself. However the documentation's guidance to save credentials in a project file would create persistent sensitive data outside the skill and should be avoided.

What to consider before installing

This skill is coherent with querying MongoDB, but proceed cautiously: - Do NOT store full connection URIs (with usernames/passwords) in plaintext project files like TOOLS.md or repo files. Use environment variables, a secrets manager, or ephemeral credentials. - Expect to install Python and the pymongo package locally before running the script. The registry metadata omits these — verify and install them yourself. - If you plan to use a Kubernetes service name, the script runs kubectl port-forward: that will use your kubeconfig and can access clusters your kubectl is authorized for. Only run this if you trust the cluster and the script. - Review the included scripts/query_mongo.py yourself (it spawns kubectl and connects to MongoDB). Look for any unexpected network endpoints or data-exfil behavior before running, and prefer running it from a non-production environment first. - Use a least-privilege, read-only MongoDB account for queries and limit query results (use --limit). If you need persistent access, consider granting scoped service accounts or secrets storage rather than saving credentials in repository files. If you want, I can list the exact lines in the script that start kubectl, parse/save URIs, and where credentials are used so you can review them quickly.

Query MongoDB with automatic connection handling (direct IP or Kubernetes port-forward).

Prerequisites

Dependencies:

• Python 3.6+
• pymongo package: pip install pymongo
• kubectl (only needed if connecting to Kubernetes service via port-forward)

The agent MUST ask user for MongoDB connection information before using this skill.

Required information:

1. MongoDB Connection String (required): Full connection URI including credentials

   • Example: mongodb://root:password@172.16.79.249:27017/?authSource=admin&replicaSet=rs0
   • Example for K8s: mongodb://root:[e-mail]:27017/?authSource=admin

2. Kubernetes Namespace (optional): Only needed if the MongoDB address is a Kubernetes service name

Recommendation: Save connection info to project's TOOLS.md for future reference:

### MongoDB

- mongo_conn_str: mongodb://user:pass@host:port/?options
- mongo_namespace: (optional - only if K8s service name)

Connection Mode

The script automatically detects connection type based on the host in connection URI:

Address Type	Connection Method
IP address (e.g., 172.16.79.249:27017)	Direct connection
K8s Service (e.g., mongodb.mongodb.svc.cluster.local:27017)	kubectl port-forward

Usage

# List all databases
python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --list-dbs

# List collections in a database
python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --db <database> --list-collections

# Execute a query
python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --db <database> --collection <name> --query '{"status": "active"}'

# For K8s service names, specify namespace
python scripts/query_mongo.py --uri "mongodb://user:[e-mail]:27017/?authSource=admin" --list-dbs --namespace mongodb

Parameters

Parameter	Description	Required
--uri	MongoDB connection string	Yes
--list-dbs	List all databases	No
--db <name>	Database name	For collection/query operations
--list-collections	List all collections in database	No
--collection <name>	Collection name	For query operations
--query <json>	MongoDB query in JSON format	No
--namespace <ns>	Kubernetes namespace (required if host is a K8s service name)	Conditional
--limit <n>	Limit number of results (default: 10)	No
--json	Output raw JSON	No

Examples

# List all databases
python scripts/query_mongo.py --uri "mongodb://root:pass@172.16.79.249:27017/?authSource=admin" --list-dbs

# Find active users
python scripts/query_mongo.py --uri "mongodb://root:pass@172.16.79.249:27017/?authSource=admin" --db production --collection users --query '{"status": "active"}'

# Query by ObjectId
python scripts/query_mongo.py --uri "mongodb://root:pass@172.16.79.249:27017/?authSource=admin" --db production --collection users --query '{"_id": {"$oid": "507f1f77bcf86cd799439011"}}'

# Limit results
python scripts/query_mongo.py --uri "mongodb://root:pass@172.16.79.249:27017/?authSource=admin" --db production --collection logs --query '{"level": "ERROR"}' --limit 20

# K8s service mode
python scripts/query_mongo.py --uri "mongodb://root:[e-mail]:27017/?authSource=admin" --db production --collection users --query '{}' --namespace mongodb

Output

• List operations: Returns database/collection names
• Query operations: Returns matching documents in formatted or JSON format