mongodb

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and usage explicitly show embedding plaintext credentials in MongoDB connection strings (passed as command arguments), which requires the LLM to construct or echo secret values verbatim in generated commands—an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill pulls and runs the external Docker image "mongo:7" (fetched from Docker Hub, e.g. https://hub.docker.com/_/mongo) at runtime, which executes remote code in the container and is a required dependency for the skill to operate.