From soundcheck
Detects NoSQL injection (CWE-943) where user input manipulates query operators ($gt, $ne, $regex, $where). Flags filter construction from unsanitized request bodies and aggregation pipelines with dynamic values.
How this skill is triggered — by the user, by Claude, or both
Slash command
/soundcheck:nosql-injectionThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Protects against NoSQL injection where user input manipulates query operators or
Protects against NoSQL injection where user input manipulates query operators or
structure. Unlike SQL injection, NoSQL injection exploits operator injection
($gt, $ne, $regex) and JavaScript execution in database engines. Exploitation
leads to authentication bypass, data exfiltration, and denial of service.
$where, $expr, or $function with a string that incorporates user inputFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
$where, $expr, and $function accept JavaScript or
expression strings that the database engine evaluates; with user input in
them, the database becomes an interpreter running attacker code.mass-assignment
skill for ORM-side details).Translate these principles to the NoSQL client library and validator of the audited file. Use the driver's documented parameterization or query-builder API — do not build filters from untyped caller-supplied objects.
$where, $expr, and $function are never used with user-supplied valuesnpx claudepluginhub thejefflarson/soundcheck --plugin soundcheckPrevents SQL, NoSQL, and command injection by enforcing parameterized queries, input validation, and safe shell execution patterns.
Hunts NoSQL injection vulnerabilities in MongoDB, CouchDB, and Redis, including auth bypass via operator injection ($gt, $ne, $regex), $where blind injection, and Redis command injection.
Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access during web penetration testing and API security reviews.