mongodb-connection
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather environmental context from the user (such as workload type and concurrency) and interpolate these values into suggested configurations and code snippets. This creates a surface where malicious user input could potentially influence the generated output.
- Ingestion points: User responses to questions about deployment environment, workload type, and performance metrics in the 'Environmental Context' section of SKILL.md.
- Boundary markers: The instructions recommend asking targeted questions one at a time, but do not provide specific delimiters or 'ignore' instructions for the agent to use when processing this external input.
- Capability inventory: The skill generates executable code snippets for various MongoDB drivers (Node.js, Python, etc.) based on user inputs.
- Sanitization: The skill lacks explicit instructions for sanitizing or validating user-provided input before it is used to construct configuration parameters or code blocks.
- [DYNAMIC_EXECUTION]: The skill generates implementation code for database clients in multiple programming languages based on templates and user-provided variables gathered during the interaction.
- [EXTERNAL_DOWNLOADS]: The skill and its monitoring guide reference official MongoDB technical specifications on GitHub and the company's official documentation site to help users set up connection monitoring.
Audit Metadata