mongodb-atlas-admin

The `scripts/atlas.sh` skill is vulnerable to command injection. User-supplied arguments for various commands (e.g., `projects create`, `clusters create`, `clusters scale`, `users create`) are directly interpolated into JSON payloads and `curl` command arguments without proper sanitization or JSON escaping. An attacker can craft malicious input containing shell metacharacters (e.g., `$(command)`, backticks, semicolons) or JSON-breaking characters (e.g., `"`). This can lead to: 1. **Arbitrary Command Execution:** Malicious shell commands embedded in input strings will be executed by the shell when constructing the `payload` variable or `curl` arguments. 2. **JSON Structure Manipulation:** Unescaped quotes or backslashes can alter the intended JSON structure, potentially leading to unauthorized API calls or data modification. 3. **Data Exfiltration/File Inclusion:** If an input string for `--data` starts with `@`, `curl` will attempt to read data from a file path specified by the attacker, potentially exfiltrating sensitive files or executing commands via named pipes. Specific vulnerable instances include: - `projects create` (line 49): `name` and `orgId` arguments. - `clusters create` (lines 65-89): `name`, `provider`, `region` arguments. - `clusters scale` (lines 109-119): `new_size`, `provider`, `region` arguments. - `users create` (lines 134-141): `username`, `password`, `role` arguments.