nosqli

NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/nosqli/SKILL.md

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exceptionally lean, executable offensive reference with strong actionability and clean section organization, but it presents destructive operations without validation/feedback steps, which caps workflow clarity at 3.

Suggestions

Add validation/verification steps for destructive and batch operations (e.g., confirm target scope before FLUSHALL, verify web-shell response after Redis SAVE).

Consider a brief ordered workflow for a typical engagement (recon → auth bypass probe → blind extraction) to give the reference a sequenced spine.

Clarify the cross-reference paths (make the payload corpus and sqli.md links explicit) to nudge progressive disclosure toward 5.

Dimension	Reasoning	Score
Conciseness	Lean and efficient: no preamble explaining what NoSQL/MongoDB is, dense copy-paste payloads, and a compact severity table; assumes Claude's competence and every token earns its place.	5 / 5
Actionability	Fully executable copy-paste curl payloads per store, concrete operator-injection JSON, and named tools (NoSQLMap, mongoaudit, fuzzdb) cover the common cases with no pseudocode.	5 / 5
Workflow Clarity	Content is organized by store rather than as a sequenced process, and destructive/batch operations (Redis FLUSHALL, web-shell write, module loading) lack validation checkpoints and feedback loops, which caps this dimension at 3 per the rubric.	3 / 5
Progressive Disclosure	Well-organized sections per store with a clear cross-references section pointing one level deep to the payload corpus and the sibling sqli.md; no bundle directories exist, so structure alone drives the score just below 5.	4 / 5
	Total	17 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, dense with concrete attack patterns and store names, and clearly distinguishable, but it lacks any explicit 'when to use' trigger clause, capping completeness at 3.

Suggestions

Add a 'Use when ...' clause naming natural trigger phrases (e.g., 'Use when testing NoSQL stores for injection, auth bypass, or blind data extraction').

Add common synonyms/aliases (e.g., 'NoSQLi', 'document database', '.json APIs') to broaden trigger coverage.

Keep the operator token list but ensure the description reads as third-person capability statements rather than only a keyword inventory.

Dimension	Reasoning	Score
Specificity	Quotes several concrete actions — 'operator injection ($ne, $gt, $where, $regex)', 'auth bypass', 'blind extraction' — and names multiple stores (MongoDB, CouchDB, Firebase, Redis); minor gaps in full coverage keep it just below 5.	4 / 5
Completeness	Clear 'what' is stated but there is no 'Use when...' or equivalent trigger guidance, which the rubric caps at 3; it is not a 2 because the 'what' is explicit and concrete.	3 / 5
Trigger Term Quality	Strong keyword coverage spanning product names users say ('MongoDB', 'CouchDB', 'Firebase', 'Redis') plus operator tokens ('$ne', '$gt', '$where', '$regex'), though a few natural synonyms/variations are absent.	4 / 5
Distinctiveness Conflict Risk	Clear niche (NoSQL injection against named stores with operator injection) with distinct triggers and minimal overlap with general SQLi or unrelated skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/nosqli/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.