Security audit
Security checks for vulnerabilities and agentic risk
This MongoDB admin skill is a plain reference, but it includes irreversible database, access-control, and replica-set commands without enough safety guardrails.
Review this skill carefully before installing it for production use. Use it only with explicit operator confirmation for destructive or topology-changing commands, verify the active connection string and database first, take fresh backups or config exports, and prefer test or temporary databases for restore/import/repair workflows.
The skill includes destructive commands such as dropping databases and collections without any cautionary language, confirmation steps, or guidance to verify the target environment first. In an agent-assisted context, these examples could be copied or suggested directly against production systems, increasing the risk of accidental irreversible data loss.
Restore, import, and repair commands can overwrite, alter, or duplicate existing data, yet the skill presents them as routine steps without warning about preconditions or rollback planning. In operational use, this can lead to accidental corruption, unexpected merges, or restoration into the wrong database, especially when used by an automated agent or less experienced operator.
User-management and replica-set administration commands can change privileges, revoke access, force topology changes, or trigger service disruption, but the skill does not warn about lockout or availability risks. Commands like role changes, user deletion, step-down, member removal, and forced reconfiguration are particularly dangerous in production and may cause outages or loss of administrative access if applied incorrectly.
