skills/soul-brews-studio/arra-oracle-skills-cli/oracle-family-scan/Snyk

oracle-family-scan

Warn

Audited by Snyk on Jul 29, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). Mode 8/9 runtime path bun $MOTHER/registry/sync.ts uses gh api graphql to fetch outsider-authored GitHub issue/discussion text from Soul-Brews-Studio/arra-oracle-v3 (and per-repo probes) into oracles.json, which later drives the AI-driven welcome flow (welcome reads title, body, author, createdAt).

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Jul 29, 2026, 02:56 AM

Issues

1

Security Audit — snyk — oracle-family-scan