feat: add NoSQL injection skill

[sandiyochristan]

Summary

The existing sql_injection skill covers relational databases (MySQL, PostgreSQL, MSSQL, Oracle). NoSQL stores have fundamentally different injection models — operator injection, structure injection, RESP protocol injection, and Lucene query injection — requiring separate guidance. MongoDB alone powers a significant portion of modern web backends, and its $ne/$gt/$regex operator injection bypassing authentication is one of the most consistently findable vulnerabilities in Node.js stacks.

This PR adds strix/skills/vulnerabilities/nosql_injection.md.

What's Added

New file: strix/skills/vulnerabilities/nosql_injection.md

MongoDB coverage:

• Operator injection ($ne, $gt, $regex, $in) for authentication bypass — both JSON body and bracket-notation form fields
• Character-by-character blind extraction via $regex with binary search methodology
• $where JavaScript injection with sleep()-based timing oracle (MongoDB < 4.4)
• Aggregation pipeline injection into $match / $lookup stages
• Mongoose {strict: false} and ODM wrapper identification

Additional NoSQL stores:

• Redis: RESP protocol injection via \r\n command smuggling
• Elasticsearch: Lucene query_string injection, Painless script injection via _update
• DynamoDB: PartiQL filter expression injection
• CouchDB: Mango query selector injection

Detection:

• Error fingerprinting (MongoError, CastError, ValidationError)
• Content-type and bracket-notation routing (Express body-parser behavior)
• Operator probe patterns for all three input formats

Test Plan

• Send {"username": {"$ne": null}, "password": {"$ne": null}} to a login endpoint — confirm bypass
• Send bracket notation username[$ne]=invalid&password[$ne]=invalid in form body — confirm same bypass
• Use $regex blind extraction to retrieve first character of a password hash or reset token
• Confirm $where timing differential on a MongoDB < 4.4 target
• Test Elasticsearch query_string with role:admin against a user search endpoint
• Run make check-all

[greptile-apps]

Greptile Summary

This PR migrates the NoSQL injection guidance from strix/prompts/vulnerabilities/nosql_injection.jinja (Jinja template format) to strix/skills/vulnerabilities/nosql_injection.md (Markdown skills format), matching the pattern used by every other vulnerability skill in the repo. The new file correctly addresses several issues from prior review rounds (correct $where version boundary at 7.0, explicit timing-oracle clarification on sleep()) and adds Neo4j Cypher injection coverage — but the CouchDB section promised in both the PR description ("CouchDB: Mango query selector injection") and the intro scope claim is entirely absent, leaving an agent told CouchDB has a distinct injection surface with no actionable guidance for it.

Confidence Score: 3/5

Hold for CouchDB section — the skill claims coverage it doesn't deliver, which will mislead agents testing CouchDB-backed targets

One P1 finding: CouchDB is declared in-scope in both the intro and the PR description deliverables list, but no CouchDB section exists in the file. This creates a false sense of coverage — the same defect flagged for Cassandra in the prior review round. Score sits at 3/5 (below the P1 ceiling of 4) because the gap directly contradicts stated deliverables.

strix/skills/vulnerabilities/nosql_injection.md — missing CouchDB section

Important Files Changed

Filename	Overview
strix/skills/vulnerabilities/nosql_injection.md	New skill file replacing the deleted Jinja prompt; comprehensive MongoDB/Redis/Elasticsearch/DynamoDB/Cassandra/Neo4j coverage but missing the CouchDB section promised in the PR description and intro scope claim
strix/prompts/vulnerabilities/nosql_injection.jinja	Deleted as part of intentional migration from prompts/ Jinja format to skills/ Markdown format; all other vulnerability skills already use this format

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
strix/skills/vulnerabilities/nosql_injection.md:8
**CouchDB listed in scope and PR description but never covered**

The introduction explicitly claims "CouchDB...each have distinct injection surfaces," and the PR description lists "CouchDB: Mango query selector injection" as a delivered item. However, CouchDB appears nowhere else in the file — no Attack Surface entry, no Key Vulnerabilities section, no testing steps. An agent loading this skill is told CouchDB has a distinct injection model but is given zero guidance on Mango query selector injection (`$eq`, `$ne`, `$gt`, `$regex` operators against `_find`), `_all_docs` manipulation, or `_design` view JavaScript injection. This is the same gap the previous review flagged for Cassandra in the old file, now recurring for CouchDB in the new file.

### Issue 2 of 2
strix/skills/vulnerabilities/nosql_injection.md:3
The frontmatter `description` lists Redis, DynamoDB, Elasticsearch, and Neo4j but omits Cassandra and CouchDB — both of which are present in the body. Skill routing and search tooling that indexes this field will not surface the skill for Cassandra or CouchDB queries.

```suggestion
description: NoSQL injection testing covering MongoDB operator injection, authentication bypass, blind extraction, GraphQL variable injection, and Redis/Elasticsearch/DynamoDB/Cassandra/CouchDB/Neo4j-specific attack surfaces
```

_{Reviews (3): Last reviewed commit: "expand nosql_injection skill, remove leg..." | Re-trigger Greptile}

[0xallam]

@greptile

[0xallam]

@greptile