nosql-injection

nosql-injection is a skill for Claude Code from emre-guler/websec. It costs 88 tokens per session (5,869 once invoked), scanned A, original, MIT.

A security review for NoSQL injection, where user input changes a query sent to a non-relational database such as MongoDB or DynamoDB.

In plain words
What is it for?
Reviewing JSON filters, login lookups, query-string parsing, document-store queries, and server-side expressions.
Why use it?
It helps find input that could alter filters, bypass a login, expose protected fields, or trigger expensive database-side code.

Skill for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable. Also seen: mentions subagents.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the websec plugin — 36 skills, 2 agents shipped together

Good fit Reviewing JSON filters, login lookups, query-string parsing, document-store queries, and server-side expressions.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add emre-guler/websec
Claude Code
/plugin install websec

Made for: Claude Code.

Or install websec, the plugin that ships this one along with the rest of its 36 skills, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for nosql-injection

README.md
[![agentmods](https://agentmods.dev/badge/skills/emre-guler/websec/nosql-injection.svg)](https://agentmods.dev/skills/emre-guler/websec/nosql-injection)
Your own site
<a href="https://agentmods.dev/skills/emre-guler/websec/nosql-injection"><img src="https://agentmods.dev/badge/skills/emre-guler/websec/nosql-injection.svg" alt="Measured on agentmods" height="20"></a>
Per session 88 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,869 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00088 $0.05869
Opus 5 $0.00044 $0.02934
Sonnet 5 $0.00018 $0.01174
Haiku 4.5 $0.00009 $0.00587

Measured 7d ago against content hash 4b8abd22f856, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

nosql-injection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/nosql-injection/SKILL.md · 166 lines

How it starts

The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.

NoSQL Injection Detection

Overview

NoSQL injection is a server-side flaw in which attacker-controlled input changes the meaning of a query sent to a non-relational datastore rather than merely supplying a value. It sits at the same application/database boundary as its relational cousin, but the control channel is different: these engines take query documents, custom APIs, or JavaScript expressions instead of a single statement grammar, so the classic break-out is joined by a second and far more common mechanism — a field that should hold a scalar arrives as an object full of query operators. The attacker is usually an unauthenticated remote user who sends a JSON body, or a query string that the body parser expands into a nested object. What they gain ranges from logging in as any account without a password, through reading fields the application never echoes by turning a comparison into a character-at-a-time oracle, to running expensive or arbitrary JavaScript on the database host. This skill finds it by locating every site where request data reaches a query filter or an evaluated expression, checking each site in parallel, and merging the results into <output_dir>/nosql-injection-results.md.

What it is NOT

  • SQL injection (/websec:sql-injection): the sink takes SQL text and the payload is SQL grammar. Test: is the sink handed a string statement, or a filter document/map? A relational driver behind an ORM belongs there even when the calling code looks similar.
  • Authentication weaknesses (/websec:authentication): a login bypassed through credential stuffing, a guessable reset token, or a broken session check is that class. Test: does the query document change shape because of client input? Only then is it injection.
  • Mass assignment and object binding (/websec:api): spreading a request body into a document that is then written sets fields the user should not control. Test: does the raw object land in the filter (injection) or in the update/insert payload (mass assignment)? Note the latter under "Also observed".
  • Access control (/websec:access-control): a query that returns another tenant's documents because no owner clause was ever applied is a missing check, not injection. Test: does the filter document change shape because of client input — a new key, an operator object, an extra clause — or does it keep its shape and only carry a value the caller should not be allowed to match on? Only the first is this class.
  • Prototype pollution (/websec:prototype-pollution): crafted __proto__ or constructor keys in a merged object corrupt the runtime rather than the query. Test: does the injected key reach the driver as an operator, or mutate a JavaScript object's prototype chain?
  • Server-side request forgery (/websec:ssrf): a connection string, host option, or $lookup-style external reference built from client input makes the server connect somewhere, not the query interpret something. Test: does the input change what the database evaluates, or where the process connects?
  • Template injection (/websec:ssti): if the string the server evaluates is handed to a template engine rather than to the driver's own script or expression runtime, it belongs there. Test: is the evaluator a render call, or the database's $where/$expr/map-reduce path?
  • Not a finding: a filter whose every field is coerced to a primitive before the query is built; a query assembled only from server-side values; an operator object that the framework's schema layer rejects at the boundary; read-only aggregation pipelines built entirely from constants; test fixtures and seed scripts.

Read the full file on GitHub · 166 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 166 lines · 88 tokens per session scan A 4b8abd22f856

Subscribe to this mod's changes

nosql-injection is a skill published in the GitHub repository emre-guler/websec (2 stars, last pushed 11d ago), licensed MIT. It adds 88 tokens to every session and 5,869 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.