mongodb-query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed MongoDB troubleshooting helper, but it encourages unsafe handling of database credentials and can automatically open Kubernetes port-forwards.

Review before installing. Use only least-privilege MongoDB credentials, avoid putting passwords in TOOLS.md or command history, prefer a protected secret source, and be careful with Kubernetes contexts because the skill can create port-forwards to services reachable by kubectl.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24
• Finding: Plaintext MongoDB credentials are recommended for persistent project storage<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-31 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Recommendation**: Save connection info to project's `TOOLS.md` for future reference: ```markdown ### MongoDB - mongo_conn_str: mongodb://user:pass@host:port/?options - mongo_namespace: (optional - only if K8s service name) ``` ``` ### Technical Analysis The Skill recommends saving a complete MongoDB connection URI, including the username and password, in the project's `TOOLS.md` file. This converts a transient secret into a persistent plaintext credential. Project files can be read by other tools and Agents, included in backups, copied into diagnostic archives, indexed by development tooling, or accidentally committed to version control. The instructions do not prescribe restrictive file permissions, repository exclusions, credential rotation, or a secret-management mechanism. ### Attack Path 1. A user provides a MongoDB URI containing valid credentials. 2. Following the Skill's recommendation, the user or Agent writes the URI to `TOOLS.md`. 3. The project directory is shared, backed up, indexed, or committed to a repository. 4. Another local user, tool, Agent, or repository reader accesses `TOOLS.md`. 5. The exposed credentials are reused to authenticate to MongoDB. 6. The attacker gains whatever database access is granted to the compromised account. ### Impact Assessment An attacker may obtain reusable MongoDB credentials. The resulting privileges depend on the database account's roles and could include reading sensitive records, enumerating databases and collections, modifying or deleting data, or performing administrative operations if a highly privileged account is used. The exposure can persist beyond the Skill invocation because the credential remains in the project file until explicitly removed and rotated. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the recommendation to store complete connection URIs in `TOOLS.md`. - Retrieve credentials from an operating-system secret store, a dedicated secrets manager, or a protected environment variable. - If file-based secret input is unavoidable, use a dedicated file outside the project tree with owner-only permissions such as mode `0600`. - Ensure all local secret files are excluded from version control and backup or diagnostic bundles. - Store non-sensitive connection metadata separately from passwords. - Document credential rotation procedures for any URI that may already have been persisted. - Use a dedicated least-privilege MongoDB account with only the permissions required for troubleshooting. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42
• Finding: Credential-bearing MongoDB URIs are passed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-58; `scripts/query_mongo.py`, lines 240-241 **Vulnerability Type**: Sensitive information exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ```bash # List all databases python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --list-dbs # List collections in a database python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --db <database> --list-collections # Execute a query python scripts/query_mongo.py --uri "mongodb://user:pass@host:27017/?authSource=admin" --db <database> --collection <name> --query '{"status": "active"}' # For K8s service names, specify namespace python scripts/query_mongo.py --uri "mongodb://user:[e-mail]:27017/?authSource=admin" --list-dbs --namespace mongodb ``` ``` The implementation requires the same command-line argument: ```python parser.add_argument('--uri', required=True, help='MongoDB connection string (e.g., mongodb://user:pass@host:port/?options)') ``` ### Technical Analysis The documented and implemented interface requires users to place the complete MongoDB URI on the process command line. When that URI contains credentials, the username and password may be exposed through: - Shell history files - Process listings and process-monitoring utilities - Command execution telemetry - CI/CD job logs - Agent transcripts - Terminal session recording - Debugging and audit infrastructure Quoting the URI prevents shell tokenization but does not hide it from process metadata or shell history. Although the script does not explicitly print the original URI, the exposure occurs before and during process execution. ### Attack Path 1. A user invokes the script using the documented `--uri` syntax. 2. The shell records the command, or the operating system exposes the argument through process ...[truncated 889 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not require credential-bearing URIs directly on the command line. - Support a protected environment variable, such as `MONGODB_URI`, while warning users that environment access must also be restricted. - Prefer reading the URI from an owner-readable secret file, file descriptor, operating-system keychain, or interactive no-echo prompt. - Permit command-line arguments only for non-sensitive connection metadata. - Redact credentials from errors, telemetry, examples, and Agent transcripts. - Add documentation warning against placing passwords in shell history. - Use short-lived credentials and dedicated least-privilege troubleshooting accounts. - Rotate any credentials previously entered into persistent command histories or logs. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:13
• Finding: Unpinned PyMongo dependency installation reduces supply-chain integrity<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-16 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code Snippet ```markdown **Dependencies:** - Python 3.6+ - `pymongo` package: `pip install pymongo` - `kubectl` (only needed if connecting to Kubernetes service via port-forward) ``` The script also repeats the unpinned installation instruction: ```python Dependencies: pip install pymongo ``` ### Technical Analysis The installation command does not specify a reviewed version, integrity hash, lock file, or trusted package index. Consequently, installations performed at different times may retrieve different dependency versions. This weakens reproducibility and makes the Skill dependent on the current state of the configured Python package index. The audit found no evidence that `pymongo` itself is malicious; the issue is the absence of controls that ensure the installed artifact is the version that was reviewed and expected. ### Attack Path 1. A user follows the documented `pip install pymongo` instruction. 2. `pip` resolves the dependency using the environment's configured package index. 3. A changed, compromised, or otherwise unintended package release is selected because no version or hash is enforced. 4. Package installation or subsequent import executes the retrieved package code. 5. That code runs with the privileges of the user invoking the Skill. This path depends on compromise or unsafe configuration of the dependency source; no such compromise was identified in the audited project. ### Impact Assessment If an unintended or compromised dependency is installed, arbitrary Python code could execute with the invoking user's privileges. This could expose MongoDB credentials, query results, local files, or Kubernetes configuration accessible to that user. Under normal trusted-index conditions, the immediate impact is primarily reduced reproducibility and uncertainty about which ...[truncated 36 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `pymongo` to a reviewed and supported version. - Declare dependencies in a version-controlled requirements or lock file. - Use cryptographic hashes, such as pip's `--require-hashes` workflow, to verify downloaded artifacts. - Install from an explicitly trusted package index. - Review and update pinned dependencies through a controlled vulnerability-management process. - Document supported Python and PyMongo versions and test those combinations. - Consider isolated virtual environments to prevent dependency conflicts and limit unintended package resolution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell and network-capable behavior but does not declare any tool scope or allowed-tools boundary. That increases the chance an agent can use broader execution or connectivity than reviewers expect, especially since the skill can reach arbitrary MongoDB endpoints and may invoke kubectl port-forward.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly recommends saving full MongoDB connection strings, including credentials, into TOOLS.md for reuse. Storing secrets in project documentation risks credential leakage through source control, logs, sharing, backups, or later agent reads, and the exposed URI can provide direct database access.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: This guidance promotes persistent storage of full connection strings with embedded usernames and passwords in reusable project files. In the context of a database-query skill, that is especially dangerous because the same file may later be read by tools, agents, or collaborators, turning troubleshooting documentation into a credential disclosure channel.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This skill does more than query MongoDB: when the host is not an IP, it automatically creates a kubectl port-forward to an in-cluster service. That expands the tool's privilege boundary from database access into Kubernetes-mediated network access, which can expose internal services and enable unintended lateral access paths if a user supplies an internal service name.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Starting port-forward: {' '.join(cmd)}", file=sys.stderr)
    
    try:
        port_forward_process = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Session Persistence

Medium

• Category: Rogue Agent

Content

cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            preexec_fn=os.setsid
        )
        
        # Wait a bit for port-forward to establish

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.