Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thejefflarson/soundcheck/nosql-injectionnpx skills add thejefflarson/soundcheck --skill nosql-injectiongit clone --depth 1 https://github.com/thejefflarson/soundcheckWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thejefflarson/soundcheck/nosql-injection)<a href="https://agentmods.dev/skills/thejefflarson/soundcheck/nosql-injection"><img src="https://agentmods.dev/badge/skills/thejefflarson/soundcheck/nosql-injection.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.00651 |
| Opus 5 | $0.00033 | $0.00326 |
| Sonnet 5 | $0.00013 | $0.00130 |
| Haiku 4.5 | $0.00007 | $0.00065 |
Grade A, and why
nosql-injection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NoSQL Injection Security Check (CWE-943)
What this checks
Protects against NoSQL injection where user input manipulates query operators or
structure. Unlike SQL injection, NoSQL injection exploits operator injection
($gt, $ne, $regex) and JavaScript execution in database engines. Exploitation
leads to authentication bypass, data exfiltration, and denial of service.
Vulnerable patterns
- Query filter built by passing a deserialized request body or query object straight into the database client, letting the caller smuggle operators in place of values
- Use of
$where,$expr, or$functionwith a string that incorporates user input - Filter value that is allowed to be an object or array when the schema expects a primitive, enabling operator injection like a not-equal match against a credential field
- Aggregation pipeline stage built from raw caller-supplied data with no field allowlist
Fix immediately
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
- Every value destined for a query filter is type-checked as a primitive. Reject anything that is not a string, number, or boolean before it reaches the query builder. The classic not-equal-empty-string auth bypass works because the deserialized payload was allowed to be an object; enforcing a primitive type turns operator keys into literal values that cannot match.
- Server-side evaluation operators never receive user-supplied values.
Operators like
$where,$expr, and$functionaccept JavaScript or expression strings that the database engine evaluates; with user input in them, the database becomes an interpreter running attacker code. - Raw request bodies and query objects are not passed directly as filters.
Build the query object explicitly from validated, named fields — the same
allowlist discipline that defeats mass assignment (see the
mass-assignmentskill for ORM-side details).
Translate these principles to the NoSQL client library and validator of the audited file. Use the driver's documented parameterization or query-builder API — do not build filters from untyped caller-supplied objects.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 58 lines · 66 tokens per session scan A 68855d0da6ba
nosql-injection is a skill published in the GitHub repository thejefflarson/soundcheck (20 stars, last pushed 1mo ago), licensed MIT. It adds 66 tokens to every session and 651 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commerce-app-storage
Integrate App Builder Database Storage (@adobe/aio-lib-db) into an Adobe Commerce app and scaffold a runtime action that reads and writes documents. Use when the user wants persistent, queryable storage backing a Commerce app — either from a web action (HTTP-invokable) or from an event/webhook handler. Requires a base…
okf-mongodb
MongoDB connector that produces and ingests Open Knowledge Format (OKF) bundles by sampling documents to infer each collection's schema. Emits one concept per collection with a Name | Type | Presence table (top-level fields, with mixed types shown as a union and presence as the percentage of sampled documents). The…
mongodb-docs
Use when users ask how to deploy, connect to, query, model, index, aggregate, secure, scale, back up, monitor, or troubleshoot MongoDB databases and applications, including Atlas, Community Edition, Enterprise Advanced, CRUD, the aggregation framework, search, vector search, transactions, change streams, replication…
mongodb-atlas-checker
Verify MongoDB Atlas setup and configuration for backend applications. Checks connection strings, environment variables, connection pooling, and ensures proper setup for Next.js and NestJS applications. Use when verifying MongoDB Atlas setup, checking connection strings or environment variables, or troubleshooting…
mongodb-natural-language-querying
Generate read-only MongoDB queries (find) or aggregation pipelines using natural language, with collection schema context and sample documents. Use this skill whenever the user asks to write, create, or generate MongoDB queries, wants to filter/query/aggregate data in MongoDB, asks "how do I query...", needs help with…
mongodb-migration-expert
Database schema design, indexing, and migration guidance for MongoDB-based applications. Use when adding or changing MongoDB collections, indexes, or fields, designing schema for multi-tenant or large datasets, or planning forward-only migrations.