The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands using curl and for loops to perform active probes against target systems. These include injecting MongoDB operators like $gt and $regex, and executing JavaScript payloads via $where to identify and exploit NoSQL injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Instructs the agent to install an external security tool using pip3 install nosqlmap. The instruction does not specify a version, which could lead to the installation of unverified or malicious packages from the public repository.
[DATA_EXFILTRATION]: The skill is explicitly designed to bypass authentication and extract sensitive records, such as admin credentials and user collections, from NoSQL databases via injection techniques.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external HTTP responses into variables (e.g., RESP=$(curl ...)). While the skill includes a safety gate requiring user authorization for the target, it lacks specific boundary markers or sanitization for the data returned from the target. The agent's capability to execute shell commands and network requests creates a surface where a malicious server could return instructions to influence the agent's behavior.

hunt-nosqli