Security audit

oracle

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent purpose, but it installs and can run an unpinned third-party npm CLI that may change after review.

Install only if you trust the @steipete/oracle npm package and its update path. Prefer a pinned reviewed version, run dry-run/file reports first, attach only necessary files, and avoid including secrets or private tokens.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party npm Package Download and Execution
Content: View full analysis
Remediation: View remediation
" ``` 2. Pin the fallback command to the same reviewed version: ```bash npx --no-install @steipete/oracle@ --help ``` If local installation is not guaranteed, use an explicitly pinned installation process rather than resolving the latest release automatically. 3. Maintain a lockfile with integrity hashes where npm installation is performed as part of a managed project. 4. Verify package provenance, signatures, checksums, and publisher identity before updating the pinned version. 5. Review release changes and transitive dependency updates before accepting a new package version. 6. Avoid `npx -y` for security-sensitive workflows because it automatically approves downloading and running code. Require explicit user confirmation and clearly disclose that external package code will execute locally. 7. Where practical, install the reviewed package in an isolated environment with restricted filesystem access, limited credentials, and constrained network permissions. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs users to execute npx -y @steipete/oracle --help without pinning an exact package version. This allows the latest published package to be fetched and executed at runtime, which creates a supply-chain risk if the package is compromised, a malicious version is published, or an unintended breaking version is resolved. In this skill context, the risk is somewhat elevated because the command directly executes code on the user's machine rather than only describing installation steps.
Content: No source excerpt is available for this finding.