Security audit

Digital Oracle

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its market-data forecasting purpose, but its unrestricted web page fetcher can reach arbitrary URLs from the user's agent environment.

Install only if you are comfortable letting the agent make outbound requests to public market-data and web-search sources. Avoid using fetch_page on untrusted or user-supplied URLs in sensitive networks, and prefer running the skill in a sandbox or with egress controls. Pin and review yfinance before enabling the Yahoo price/options providers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: digital_oracle/providers/web.py:386
Finding: Arbitrary URL Fetching Permits Server-Side Request Forgery
Content: View full analysis
Vulnerability Details

File Location: digital_oracle/providers/web.py:386-391
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: Medium

Vulnerable code:

python
def fetch_page(self, query: WebPageQuery | str) -> WebPageContent: """Fetch a URL and extract its text content.""" if isinstance(query, str): query = WebPageQuery(url=query) html = self.http_client.fetch(query.url)

Technical Analysis

WebSearchProvider.fetch_page() accepts a caller-controlled URL and passes it directly to the HTTP client. The associated UrllibSearchClient.fetch() implementation uses urllib.request.urlopen() without enforcing an allowed scheme or destination policy.

The implementation does not:

Restrict requests to HTTPS.

Reject loopback, private, link-local, reserved, or multicast addresses.

Block known cloud metadata addresses.

Reject embedded URL credentials.

Restrict requests to approved financial-data domains.

Resolve and validate hostnames before connecting.

Revalidate the destination after HTTP redirects.

Consequently, an attacker who can influence the URL supplied to the Skill may cause the host running the Agent to send requests to services that are inaccessible from the attacker's own network. Automatic redirect handling may also allow an initially public URL to redirect to a prohibited internal destination.

Attack Path

An attacker submits a financial-analysis request containing or referencing a crafted URL.

The Agent chooses WebSearchProvider.fetch_page() to retrieve the referenced page.

fetch_page() passes the URL to UrllibSearchClient.fetch() without destination validation.

The HTTP client sends the request from the Agent's network environment.

The target may be a loopback service, private-network application, or cloud metadata endpoint.

The response is converted into text and returned as `WebPageCo ...[truncated 963 chars]
Remediation: View remediation
Remediation Suggestions

Permit only https URLs and reject unsupported schemes such as file, ftp, data, and gopher.

Reject URLs containing user-information components such as username:password@host.

Resolve the hostname before connecting and reject every resolved loopback, private, link-local, reserved, multicast, or unspecified IP address.

Explicitly block cloud metadata destinations, including link-local metadata addresses and provider-specific metadata hostnames.

Disable automatic redirects or validate the scheme, hostname, and resolved address at every redirect hop.

Prefer an explicit allowlist of trusted financial and market-data domains if arbitrary browsing is not essential.

Apply outbound firewall or proxy rules so application-level validation is not the only defense.

Limit response sizes and request duration to reduce resource-exhaustion risk.

Add tests covering IPv4, IPv6, alternative address representations, DNS rebinding scenarios, and public-to-private redirects.

T08 · Insecure Dependencies

Note

Location: README.en.md:78
Finding: Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
Vulnerability Details

File Location: README.en.md:78-82
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable installation guidance:

markdown
- [uv](https://docs.astral.sh/uv/) — Python package manager, used to run skill scripts at runtime - 11 out of 12 data sources have zero external dependencies (pure Python stdlib). Options chain analysis requires an extra install: ```bash uv pip install yfinance

text
Equivalent unpinned installation guidance also appears in `SKILL.md:309-310`. ### Technical Analysis The project directs an Agent or user to install `yfinance` without a fixed version, lockfile, or package hash. The resolved package and its transitive dependencies can therefore change after the Skill has been reviewed. Python package installation may execute package build or installation logic, and imported packages execute module initialization code. Installing the latest available version at runtime consequently expands the trusted computing base to mutable third-party artifacts that were not part of this audit. No typographical package-name mismatch, dependency-confusion namespace, malicious package, or nonstandard package repository was identified. The risk arises from non-reproducible, unverified dependency resolution rather than evidence that the named package is currently malicious. ### Attack Path 1. The Agent follows the documented instruction when Yahoo price-history or options-chain functionality is requested. 2. `uv` resolves the latest available `yfinance` package and its transitive dependencies. 3. A compromised, malicious, or unexpectedly changed release is downloaded. 4. Package installation or subsequent import executes code from that release. 5. The dependency code runs with the privileges of the Agent process. Exploitation therefore depends on compromise of the package distribution channel, a dependency release, or dependency resolution ...[truncated 690 chars]
Remediation: View remediation
Remediation Suggestions

Pin yfinance to a specifically audited version rather than resolving the latest release.

Maintain a lockfile covering all transitive dependencies.

Require package hashes and fail installation if artifact integrity verification fails.

Install dependencies only from an explicitly configured, trusted package index.

Perform installation in an isolated virtual environment with minimal filesystem and network privileges.

Review and update the dependency set through a controlled process with automated vulnerability and provenance checks.

Keep the pinned version in README.en.md, SKILL.md, and any other installation instructions consistent.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (77)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk is infrastructure for parallel execution, not a forecasting or market-analysis skill. It does not access prediction markets, commodities, equities, options chains, derivatives, yield curves, or currencies, and it does not compute probabilities or generate structured prediction reports. While concurrency could be a supporting implementation detail inside such a system, this chunk by itself has a materially different primary purpose than the declared description. Therefore the description does not accurately represent what this supplied code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is much broader and centers on answering prediction questions using traded market data across many asset classes and prediction markets. The actual code only implements a narrow data provider for BIS macroeconomic statistics, specifically policy rates and credit gaps. It does not access prediction markets, options chains, equities, commodities, currencies, or yield curves in this snippet, nor does it generate forecasts, probabilities, or reports. While BIS macro data could be a supporting signal in a larger forecasting system, this code chunk’s concrete behavior is materially narrower than the declared purpose, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code chunk does not perform the broad forecasting function described. It only retrieves and parses one specific data source: CFTC Commitments of Traders positioning data, with capability explicitly labeled as 'positioning'. It does not answer questions, compute probabilities, generate structured probability reports, access prediction markets, equities, options chains, yield curves, currencies, or combine multiple signals. While CFTC commodity/derivatives positioning is loosely related to market data mentioned in the description, this code's actual purpose is much narrower and materially different from the declared end-user behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises a general-purpose forecasting skill using many types of traded market signals across numerous domains. The actual code chunk is much narrower: it only retrieves and parses CME FedWatch implied probabilities for Fed funds target ranges at scheduled meetings. This is a finance-related signal provider and could support part of a broader economics/markets prediction system, but by itself it does not match the declared primary purpose of broad probability answering across domains with multiple data sources and cross-validation. There are no suspicious undeclared side capabilities beyond network access to the CME JSON endpoint; the mismatch is mainly that the implementation shown is substantially narrower than the advertised functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad forecasting skill that answers probability questions using prediction markets and multiple traded signals across many asset classes. The supplied code does not do that. It only accesses CoinGecko endpoints for crypto prices, global crypto metrics, and coin market listings. There is no logic for prediction markets, no options/equities/commodities/yield-curve/currency data access, no probability inference, and no structured forecasting/report synthesis. While crypto market data is a market signal, this code chunk is materially narrower than the declared purpose and does not implement the core advertised behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear mismatch. The declared description promises a forecasting skill that uses traded market signals from prediction markets and multiple financial instruments to answer probability questions. The supplied code does not perform forecasting, probability estimation, or broad market data aggregation. Instead, it accesses SEC EDGAR resources only: company ticker mappings, submissions, and search APIs. Its concrete capabilities are limited to resolving tickers, retrieving recent Form 4 insider filings, and searching SEC filings. Those are materially different from the declared primary purpose and add undeclared capabilities related to regulatory filing retrieval.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises a broad forecasting capability driven by real-money trading signals across many market types, especially prediction markets, and says it produces structured probability assessments. The supplied code does not do that. It only accesses one external resource: CNN's Fear & Greed Index, a sentiment indicator. It parses a score, rating, timestamp, and prior values. There is no evidence here of prediction market access, options/equities/commodities/yield-curve/currency ingestion, multi-source cross-validation, or probability estimation/report generation. While market sentiment could be a supporting signal for the broader skill, this code chunk's actual purpose is materially narrower than the declared behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code is narrowly scoped to a Kalshi provider. It accesses only the Kalshi prediction market API and exposes capabilities explicitly labeled as event_markets and order_book. It parses market/event/order book payloads and computes implied yes probabilities from bids/asks or last price. There is no evidence of reading commodities, equities, options chains, derivatives, yield curves, or currencies, and no logic for combining multiple sources into a structured probability report. Thus the declared description materially overstates and broadens the skill’s behavior beyond what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk is narrowly scoped to a single provider for Polymarket. It defines data models and methods to list/get events and fetch order books via Polymarket endpoints, then parses market/outcome/order-book fields. There is no implementation for accessing commodities, equities, options chains, yield curves, currencies, or multiple external signal sources, and no logic to synthesize a final structured probability report. While the declared purpose includes prediction-market usage, it substantially overstates the implemented breadth and cross-validation behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk is a simple model/schema layer for historical price data and query parameters. It does not implement the declared end-user behavior of analyzing real-money market signals to answer probability questions. While these classes could support a larger pricing system, this chunk by itself has a materially narrower and different purpose than the declared skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk is narrowly focused on retrieving two specific U.S. Treasury-related datasets: Treasury yield curves and Treasury/FiscalData exchange rates. It defines data models, query helpers, HTTP fetches, and CSV/JSON parsing for those sources. It does not implement answering questions, estimating probabilities, generating structured prediction reports, or accessing prediction markets, equities, options chains, commodities, or other traded outcome markets described in the declaration. While yield curves and currencies are mentioned in the declared description, this code only covers a small subset of that description and lacks the core stated purpose of prediction-question answering based on broad market trading data. Therefore the declared description materially overstates and misrepresents the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a domain-specific forecasting capability grounded in real-money market data and cross-validation across financial/prediction instruments. The supplied code chunk instead provides only low-level web search and page-text retrieval utilities. While such web access could be a supporting component in a larger system, this chunk itself does not read prediction market prices, equities, options chains, commodities, derivatives, yield curves, or currencies, nor does it compute probabilities or produce structured forecasting outputs. Therefore the actual behavior is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose centers on market-implied probability analysis using real-money trading signals across multiple financial and prediction-market sources. This code chunk does something materially different: it retrieves historical indicator data from the World Bank API. While World Bank macro data could be a supporting input to broader economic analysis, this specific code neither accesses trading/market data nor computes probabilities, valuations, or cross-validated reports. Its primary purpose is an economic indicator provider, which is not accurately represented by the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code does not answer user questions, estimate probabilities, or cross-validate multiple market signals. It only retrieves historical OHLCV price data from Yahoo Finance for a single symbol and formats it into a PriceHistory object. While this is tangentially related to part of the description's mention of equities/commodities/currencies, it is far narrower than the declared purpose. There is no evidence of prediction market ingestion, options chains, derivatives surfaces, yield curves, or any structured probability report generation. Therefore the description materially overstates and misrepresents the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk does not implement a general forecasting or probability-answering skill. It is a specific market data provider for Yahoo Finance options chains on equities, with analytics around Greeks and option-chain statistics. While the declared description mentions options chains as one of many inputs, it promises much broader functionality: prediction markets, commodities, currencies, yield curves, cross-signal validation, and production of structured probability reports for topics like wars, recessions, and geopolitics. None of that broader orchestration or inference behavior appears here. The actual code's primary purpose is materially narrower and different from the declared end-user capability, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code chunk does not perform market-data analysis, probability estimation, signal cross-validation, or structured forecasting. Its primary function is infrastructure for capturing HTTP responses to local JSON files and replaying them later. That is a materially different purpose from the declared end-user skill description. While such snapshotting could be a supporting utility within a larger system, this chunk itself exposes undeclared capabilities—persistent filesystem storage and replay of network responses—and lacks the declared behavior of answering prediction questions from trading data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code is a narrow demonstration script for querying a Deribit provider and printing futures, options, or order book data based on CLI arguments. It contains no logic for estimating probabilities, synthesizing geopolitical/economic forecasts, or combining multiple asset-class signals. While options/futures data are consistent with part of the declared domain, the implemented behavior is materially narrower and different in purpose from the description, which promises a broad market-based prediction engine.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises a user-facing forecasting skill that synthesizes many kinds of trading data to answer probability questions. The supplied code chunk instead implements a narrow Kalshi demo utility: it parses CLI flags, fetches Kalshi events/markets/order books via a provider, and prints normalized fields. While Kalshi prediction-market access is consistent with a small subset of the declared purpose, the primary behavior is materially narrower than described. There is no evidence here of multi-source data ingestion, cross-signal validation, structured probability analysis, or natural-language question answering. Therefore the declared description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad forecasting skill that synthesizes many market data sources to answer user probability questions. The supplied code, however, only interacts with a single provider: Polymarket. It lists or fetches events by slug, prints a basic market snapshot, and optionally retrieves an order book for the YES token. There is no evidence of accessing other market types like equities, options, commodities, yield curves, or currencies, and no logic for cross-validating multiple signals or generating a structured analytical report. The code's primary purpose is a Polymarket data retrieval/demo CLI, which is materially narrower than the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description promises a broad forecasting skill that answers probability questions using traded market signals from prediction markets, commodities, equities, options chains, derivatives, yield curves, and currencies. The code chunk only implements a command-line demo for one provider (Stooq) and one task: retrieving and printing historical OHLCV price data for a symbol. This is materially narrower and different in primary purpose. While equities/currency history could be a supporting data source for a larger forecasting system, this specific code does not actually perform the declared end behavior, nor does it access the key resources emphasized in the description such as prediction markets or options chains.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad forecasting capability driven by market-implied probabilities across many asset classes and prediction markets. The actual code chunk only implements a command-line demo for fetching U.S. Treasury yield curve observations and exchange rates via a USTreasuryProvider, then printing them. While yield curves and currencies are mentioned in the description, this code alone does not perform any forecasting, probability estimation, cross-signal validation, or access to prediction markets, options, equities, commodities, or derivatives. Its primary purpose is materially narrower and different from the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk does not implement a forecasting or market-implied probability engine. Instead, it tests a specific data provider for Bank for International Settlements datasets, limited to policy rates and credit gaps. There is no evidence of prediction market ingestion, options/equities/commodities access, probability estimation, or report generation. The actual behavior is a narrow macroeconomic data retrieval/parsing component, which is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code chunk does not implement the declared user-facing forecasting skill. Instead, it tests a narrow provider for CFTC Commitments of Traders data. That is a supporting market-data component focused on commodity futures positioning, with no evidence of probability estimation, prediction-market integration, options/equities/yield-curve/currency ingestion, or structured forecast report generation. While commodity market data is loosely related to the declared domain, the actual code's primary purpose is materially different and much narrower than the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description claims a general-purpose forecasting skill powered by many financial and prediction data sources. The actual code chunk is narrowly scoped test code for one provider: CME FedWatch, which appears to parse Federal Reserve rate probability data. That is a much smaller and more specific capability than described. The code shown does not implement the claimed broad prediction engine, question answering behavior, or multi-source signal aggregation. While FedWatch rate probabilities are related to market-implied probabilities, the supplied chunk materially under-supports the declared primary purpose and instead reflects a specialized interest-rate probability provider test.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a clear mismatch. The declared description claims a sophisticated forecasting skill that reads from prediction markets, commodities, equities, options, derivatives, yield curves, and currencies to answer probability questions. The actual code shown is only a test module for low-level numeric coercion helpers. Its behavior is limited to validating conversion of inputs into floats/ints and rejecting invalid values. There is no evidence of data-source access, trading signal processing, market inference, or user-facing probability outputs. This is not a supporting implementation detail of the declared capability in any meaningful sense; the code chunk’s primary purpose is unrelated utility testing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Static analysis