Security audit

mongodb-query

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed MongoDB troubleshooting helper, but it encourages unsafe handling of database credentials and can automatically open Kubernetes port-forwards.

Review before installing. Use only least-privilege MongoDB credentials, avoid putting passwords in TOOLS.md or command history, prefer a protected secret source, and be careful with Kubernetes contexts because the skill can create port-forwards to services reachable by kubectl.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Plaintext MongoDB credentials are recommended for persistent project storage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: Credential-bearing MongoDB URIs are passed through command-line arguments
Content: View full analysis
--list-collections # Execute a query python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --db --collection --query '{"status": "active"}' # For K8s service names, specify namespace python scripts/query_mongo.py --uri "mongodb://user:pass@svc.ns.svc.cluster.local:27017/?authSource=admin" --list-dbs --namespace mongodb ``` ``` The implementation requires the same command-line argument: ```python parser.add_argument('--uri', required=True, help='MongoDB connection string (e.g., mongodb://user:pass@host:port/?options)') ``` ### Technical Analysis The documented and implemented interface requires users to place the complete MongoDB URI on the process command line. When that URI contains credentials, the username and password may be exposed through: - Shell history files - Process listings and process-monitoring utilities - Command execution telemetry - CI/CD job logs - Agent transcripts - Terminal session recording - Debugging and audit infrastructure Quoting the URI prevents shell tokenization but does not hide it from process metadata or shell history. Although the script does not explicitly print the original URI, the exposure occurs before and during process execution. ### Attack Path 1. A user invokes the script using the documented `--uri` syntax. 2. The shell records the command, or the operating system exposes the argument through process ...[truncated 889 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:13
Finding: Unpinned PyMongo dependency installation reduces supply-chain integrity
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell and network-capable behavior but does not declare any tool scope or allowed-tools boundary. That increases the chance an agent can use broader execution or connectivity than reviewers expect, especially since the skill can reach arbitrary MongoDB endpoints and may invoke kubectl port-forward.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly recommends saving full MongoDB connection strings, including credentials, into TOOLS.md for reuse. Storing secrets in project documentation risks credential leakage through source control, logs, sharing, backups, or later agent reads, and the exposed URI can provide direct database access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This guidance promotes persistent storage of full connection strings with embedded usernames and passwords in reusable project files. In the context of a database-query skill, that is especially dangerous because the same file may later be read by tools, agents, or collaborators, turning troubleshooting documentation into a credential disclosure channel.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill does more than query MongoDB: when the host is not an IP, it automatically creates a kubectl port-forward to an in-cluster service. That expands the tool's privilege boundary from database access into Kubernetes-mediated network access, which can expose internal services and enable unintended lateral access paths if a user supplies an internal service name.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/query_mongo.py (reported line 130)May include surrounding context.
python
print(f"Starting port-forward: {' '.join(cmd)}", file=sys.stderr) try: port_forward_process = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/query_mongo.py (reported line 134)May include surrounding context.
python
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, preexec_fn=os.setsid ) # Wait a bit for port-forward to establish