oci
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Oracle Cloud Infrastructure (OCI) CLI installation script from Oracle's public GitHub repository (https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh) for system setup.
- [COMMAND_EXECUTION]: Executes multiple shell scripts to automate cloud resource management, including 'oci-infrastructure-setup.sh', 'check-oci-capacity.sh', and 'cleanup-compartment.sh'.
- [COMMAND_EXECUTION]: The 'monitor-and-deploy.sh' script provides a feature to execute user-defined notification commands via 'eval' after successful resource provisioning.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it interpolates user-supplied parameters like 'SERVER_NAME' and 'OCI_REGION' into shell scripts.
- Ingestion points: User-provided parameters in 'SKILL.md' and environment configuration in '.env' files.
- Boundary markers: Explicit logical boundaries in instructions requiring user confirmation of parameters.
- Capability inventory: Full access to OCI CLI and local shell execution across all scripts.
- Sanitization: Relies on standard shell variable handling without additional explicit validation logic.
Audit Metadata