The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to utilize external command-line tools such as NoSQLMap for automated injection and mongosh for direct database connectivity and manual testing.
[DATA_EXFILTRATION]: Provides automated Python script templates in references/nosql-payloads.md that implement blind injection logic to extract sensitive data, such as passwords, from remote database fields by evaluating server response differences.
[EXTERNAL_DOWNLOADS]: Includes functional Python code that imports and utilizes the requests library to perform network operations against remote URLs specified by the user.
[DYNAMIC_EXECUTION]: Describes techniques for leveraging the MongoDB $where operator, which allows for the execution of arbitrary JavaScript logic within the database server's context to facilitate blind injection or data discovery.
[INDIRECT_PROMPT_INJECTION]: The skill requires the agent to parse and interpret untrusted data returned from remote targets, including HTTP response codes and BSON error strings (e.g., MongoError, CastError), which constitutes a vulnerability surface if the remote target provides malicious or deceptive responses to influence the agent's logic.
Ingestion points: Server responses from HTTP POST requests and database error messages (SKILL.md).
Boundary markers: None identified in the provided templates for handling remote responses.
Capability inventory: Python requests calls, nosqlmap execution, and mongosh commands (SKILL.md, references/nosql-payloads.md).
Sanitization: No explicit sanitization or validation logic is provided for the data received from external target servers.

nosql-injection