api-database-mongodb
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices for secret management by utilizing environment variables and provides guidance on preventing resource exhaustion through proper connection pooling.
- [SAFE]: The documentation explicitly addresses injection risks, providing robust patterns for validating and coercing untrusted user input before it reaches the database driver.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling external data in database operations, identifying the relevant attack surface.
- Ingestion points: External data from request bodies (req.body) is processed in queries as shown in examples/queries.md.
- Boundary markers: The skill uses explicit 'Red Flags' and instructional guides to separate instructions from data inputs.
- Capability inventory: The driver allows full CRUD access to MongoDB collections.
- Sanitization: Defensive patterns like primitive coercion and regex-based ID validation are explicitly documented.
Audit Metadata