Oracle Fusion Cloud Financials

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This Oracle Financials skill appears legitimate, but it should be reviewed because it enables broad changes to sensitive financial systems without documented approval safeguards.

Install only if you intend to let an agent work with Oracle Fusion Cloud Financials. Use a least-privilege Membrane/Oracle connection, avoid granting write or delete permissions unless needed, and require explicit human approval before creating, updating, posting, paying, journaling, or deleting financial records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents a generic proxy mechanism that supports state-changing HTTP methods like POST, PUT, PATCH, and DELETE against a financial system API without requiring confirmation, scoping, or warning about destructive operations. In the context of ERP/financial data, this increases the risk that an agent could modify invoices, payments, journals, or other sensitive records based on an ambiguous prompt or incorrect action selection.

VirusTotal

64/64 vendors flagged this skill as clean.