EVEZ Oracle Bridge

AdvisoryAudited by Static analysis on May 12, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

User prompts or model requests may be sent to an additional service that is not clearly disclosed in the skill description.

Why it was flagged

SKILL.md describes routing through the user's Vultr oracle, but the code defines a separate EVEZ-hosted fallback API with its own key. If used, prompts could leave the stated Vultr-only provider boundary.

Skill content

# Also try EVEZ API as fallback
EVEZ_API_URL = "https://evez-api2.fly.dev/v1"
EVEZ_API_KEY = "EVEZ_API_KEY_REDACTED"

Recommendation

Disclose all upstream providers, remove the fallback unless explicitly requested, and require user confirmation before sending prompts outside the Vultr endpoint.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

A user may not realize the skill will use a Vultr API key or what account authority that key grants.

Why it was flagged

The code uses a Vultr API key, while the registry metadata declares no required environment variables and no primary credential. This under-discloses the credential boundary.

Skill content

ORACLE_KEY = os.environ.get("VULTR_API_KEY", "VULTR_API_KEY_REDACTED")

Recommendation

Declare VULTR_API_KEY as a required credential, document the minimum required scope, and avoid hardcoded or fallback credentials.

ConcernMedium Confidence

ASI02: Tool Misuse and Exploitation

What this means

If the bridge is reachable, callers may be able to trigger local agentic workflows such as evolve or cycle operations.

Why it was flagged

The bridge can trigger local EVEZ services that appear to mutate or run agentic processes, with no visible approval or authentication checks in the provided handler code.

Skill content

result = await call_service("forge", "/api/evolve", "POST", {"goal": goal})
...
result = await call_service("cycler", "/api/trigger", "POST", {})

Recommendation

Bind only to localhost unless explicitly intended, add authentication, and require explicit user approval for mutation or trigger endpoints.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Untrusted inputs could poison the local knowledge graph and affect later responses or agent behavior.

Why it was flagged

The handler forwards arbitrary request JSON into a knowledge service's learn endpoint, which can persist or influence later knowledge retrieval.

Skill content

async def handle_learn(request):
    """POST /api/learn {"concept": "...", "relation": "...", "target": "..."}"""
    ...
    result = await call_service("knowledge", "/api/learn", "POST", body)

Recommendation

Restrict who can call learning endpoints, validate submitted concepts, and provide a way to review and remove stored knowledge.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The user may need to install dependencies manually and cannot verify dependency versions from the skill metadata.

Why it was flagged

The skill includes runnable Python code with third-party dependencies, but the artifacts provide no install spec or dependency declaration. This is not malicious by itself, but setup and provenance are incomplete.

Skill content

import aiohttp
from aiohttp import web

Recommendation

Add an install spec or dependency manifest with pinned package versions and clear setup steps.