The Agent Skills Directory

[SAFE]: The skill demonstrates secure handling of database credentials by recommending the use of environment variables rather than hardcoding sensitive connection strings.
[SAFE]: The documentation includes high-priority security warnings against NoSQL injection. It provides practical code examples for input coercion and validation (e.g., parseStatus, parseObjectId) to prevent attackers from injecting MongoDB operators into queries.
[SAFE]: The skill promotes proper resource management by requiring the reuse of a single MongoClient instance, which prevents connection exhaustion attacks or accidental DoS of the database server.
[INDIRECT_PROMPT_INJECTION]: The skill addresses the risk of processing data from external database sources by promoting a zero-trust approach to data crossing boundaries. 1. Ingestion points: Data retrieved from MongoDB collections via find, findOne, and aggregate (found in examples/queries.md and examples/aggregation.md). 2. Boundary markers: Recommends the use of explicit validation wrappers at application entry points. 3. Capability inventory: Performs database read/write, aggregation pipelines, and transaction management. 4. Sanitization: Provides specific logic to coerce untrusted inputs into safe primitives before they are used in query filters.

api-database-mongodb