Oracle-X API

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 12:30 PM UTC
• Version: 1.0.5

Overview

This is a coherent Oracle-X API helper that makes disclosed calls to a user-configured financial terminal, with optional credentials only for user-scoped features.

Install this only if you run or trust the Oracle-X instance you configure. Treat ORACLE_X_TOKEN as a live account credential, avoid pasting it unless an authenticated endpoint is needed, and remember that chat or analysis job endpoints may use the operator's LLM/provider budget.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Credential Access

High

• Category: Privilege Escalation

Content

description: Base URL of the running Oracle-X instance. Defaults to http://localhost:8000.
      - name: ORACLE_X_TOKEN
        required: false
        description: Supabase access token, needed only for the chat and watchlist endpoints.
---

# Oracle-X

• Confidence: 88% confidence
• Finding: The skill uses an access token from the environment to authenticate to chat and watchlist endpoints, creating a credential-handling path. Even though the document says not to write the token to files, URLs, or logs, the presence of bearer-token usage combined with missing strict tool scoping means a compromised or overly permissive agent could access and transmit the credential.

Ae1

High

• Category: analysis-evasion

Content

in `references/endpoints.md`, call it.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

in `references/endpoints.md`, call it.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

in `references/endpoints.md`, call it.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

in `references/endpoints.md`, call it.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|---|---|
| `POST /api/chat` | Runs on the caller's own LLM provider settings. |
| `POST /api/chat/jobs`, `GET /api/chat/jobs/{job_id}` | A chat job holds a question and its answer. |
| `GET/POST/DELETE /api/chat/history`, `/api/chat/sessions*` | The caller's conversations. |
| `GET/POST/DELETE /api/home/watchlist` | The caller's tracked symbols. |
| `POST /api/analysis/jobs/{timeframe}` | Generation spends the instance's provider budget. |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `POST /api/chat` | Runs on the caller's own LLM provider settings. |
| `POST /api/chat/jobs`, `GET /api/chat/jobs/{job_id}` | A chat job holds a question and its answer. |
| `GET/POST/DELETE /api/chat/history`, `/api/chat/sessions*` | The caller's conversations. |
| `GET/POST/DELETE /api/home/watchlist` | The caller's tracked symbols. |
| `POST /api/analysis/jobs/{timeframe}` | Generation spends the instance's provider budget. |

Prices, technicals, candles, news, analysis reports, macro, chains,

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

use. This returns an access token valid for an hour:

   ```bash
   curl -sf -X POST \
     "$SUPABASE_URL/auth/v1/token?grant_type=password" \
     -H "apikey: $SUPABASE_ANON_KEY" \
     -H 'Content-Type: application/json' \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

```

- `200` — the token is good.
- `401` — missing, malformed or expired. Supabase access tokens are short-lived;
  an hour-old token is usually the explanation.
- `403` — the account is suspended. `get_current_user` refuses suspended
  accounts at the one choke point every authenticated route passes through.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of network access and environment variables, including a bearer token, but does not declare a restrictive tool scope or allowlist. That increases the chance an agent can make unintended outbound requests or access sensitive env data beyond what is necessary for the skill's purpose.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The invocation description is extremely broad and says to prefer this skill for many common finance questions and whenever localhost:8000 is listening. That can cause over-invocation, including sending user prompts and symbols to a local or configured service without a sufficiently narrow trigger boundary or user awareness.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
BASE="${ORACLE_X_URL:-http://localhost:8000}"

curl -sf "$BASE/api/price/BTCUSDT"
curl -sf "$BASE/api/technical/AAPL"
curl -sf "$BASE/api/rag/query?q=bitcoin%20halving%20price%20behavior&symbol=BTC"
curl -sf -H "Authorization: Bearer $ORACLE_X_TOKEN" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

use. This returns an access token valid for an hour:

   ```bash
   curl -sf -X POST \
     "$SUPABASE_URL/auth/v1/token?grant_type=password" \
     -H "apikey: $SUPABASE_ANON_KEY" \
     -H 'Content-Type: application/json' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Line L016 directs the skill to respond in a particular way whenever Turkish-market terms are mentioned, effectively imposing a locale-specific handling policy rather than offering the user a choice. The rule for natural-language policy violations applies to all file types and covers forced language/locale behavior without opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says this skill deliberately does not cover BIST, TEFAS, KAP, or VİOP and that those belong to the sibling skill `oracle-x-bist`. However, the documented `/api/market/indices` endpoint explicitly includes `BIST` among the global indices, which broadens the skill's described surface into the excluded Turkish-market domain.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.