Oracle

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:48 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent usage guide for the Oracle CLI, with a real but disclosed supply-chain caution around unpinned npm execution.

Before installing, verify the @steipete/oracle package source and consider pinning a reviewed version. Use dry-run and files-report first, attach only the files needed for the task, avoid secrets such as .env files and tokens, and remember that sessions may persist under ~/.oracle/sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-18 and line 43
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "@steipete/oracle",
      "bins": ["oracle"],
      "label": "Install oracle (node)",
    },
  ],

sh

npx -y @steipete/oracle --help

Technical Analysis

The Skill specifies @steipete/oracle without an exact version or integrity hash. It also recommends npx -y, which may download and immediately execute the package version currently resolved by the package registry without interactive confirmation.

Consequently, the code executed by users is not immutable relative to the reviewed Skill. A malicious or compromised future package release could behave differently from the version that existed when this file was audited. This creates a supply-chain exposure even though no malicious code is embedded directly in the repository.

Attack Path

1. An attacker compromises the package publisher account, package registry path, or another relevant release mechanism.
2. The attacker publishes a malicious version under @steipete/oracle that remains compatible with unversioned resolution.
3. A user follows the documented npx -y @steipete/oracle --help command or installs the dependency through the unpinned package metadata.
4. The package manager retrieves the attacker-controlled release and executes package lifecycle logic or the package binary with the invoking user's privileges.
5. The malicious package accesses data or performs operations available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user invoking the package manager. Depending on the local environment, the compromised dependency could read repository contents, environment v ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, such as @steipete/oracle@X.Y.Z, rather than resolving an unspecified current release.
2. Manage installation through a committed lockfile containing registry resolution and integrity metadata.
3. Avoid recommending npx -y because it downloads and executes code without confirmation. Prefer a separately reviewed installation step followed by invocation of the installed binary.
4. Verify package provenance, the expected publisher, and the official registry before installation.
5. Where supported, require signature or provenance verification and validate package integrity against an independently recorded digest.
6. Execute the tool with least privilege in a sandbox or container, exposing only the repository files required for the task.
7. Establish an update-review process so new dependency versions are assessed before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill recommends executing a package directly from the registry via npx -y @steipete/oracle without pinning to a specific version. That creates a supply-chain risk: users may unknowingly run a newly published or compromised version, and because this is presented as an install/help fallback in a CLI skill, readers are likely to copy-paste it directly into a shell.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.