nosqlmap

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs are not direct, trusted binary downloads but rather a third‑party GitHub pentesting repo plus documentation and target CouchDB endpoints (port 5984) referenced for exploitation — meaning they can facilitate malware or unauthorized access and should be treated as suspicious/untrusted.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is explicit offensive tooling: it provides actionable NoSQL injection payloads and workflows that enable unauthorized data exfiltration (blind queries, db.find), credential theft/auth bypass, server‑side JS remote code execution via $where, and system compromise (e.g., creating admin CouchDB users), indicating clear malicious/abusive intent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start explicitly instructs to "git clone https://github.com/codingo/NoSQLMap" and then run "python3 setup.py install", which fetches remote code from that GitHub URL and executes it during installation/runtime, so it is a runtime external dependency that executes remote code.