ClawHub
Back to skill

Security audit

OracleNet — Live Data & Capability Router for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed live-data router with payment safeguards, but users should avoid custom or non-HTTPS endpoints.

Install only if you want agents to route tasks through ToolOracle for live external data. Keep the default HTTPS endpoint, do not put secrets or personal data in routing intents, and require explicit approval and a stated budget before any x402 payment.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill clearly instructs the agent to make outbound network requests to external endpoints such as /handshake, MCP servers, and multiple well-known discovery files, yet the only static finding indicates no declared permissions for that capability. Undeclared network access is a real security issue because it bypasses user/runtime visibility and policy enforcement, increasing the risk of unintended data exfiltration, SSRF-style misuse through agent-driven requests, or unauthorized external interactions.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The docstring says the script posts to a fixed free OracleNet handshake endpoint, but the CLI exposes `--endpoint` and only checks for an `http(s)://` prefix. In a skill context, an agent or caller may trust the documentation and unknowingly send task intents to an attacker-controlled service, creating a clear SSRF/data-exfiltration route for prompts or sensitive operational metadata.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The code accepts both `http://` and `https://` endpoints, even though the script transmits user intent text that may contain sensitive task descriptions despite the lightweight secret scan. Allowing plaintext HTTP enables interception and tampering by a network attacker or malicious proxy, and in this skill's routing role that can misdirect downstream tool use or leak operational intent.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/smoke_test.py:193