The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions rely on npx -y @steipete/oracle to execute the core functionality. Using the -y flag (or --yes) automatically downloads and runs code from the NPM registry without requiring manual approval of the package or its version, which can lead to the execution of unverified third-party scripts.
[DATA_EXFILTRATION]: The skill is designed to bundle local repository content (specified via --file globs) and send it to external AI services using either API keys or browser automation. This behavior involves transmitting potentially sensitive intellectual property or project metadata to third-party infrastructure.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for managing sessions, viewing help, and starting a network-accessible server (oracle serve --host 0.0.0.0). The server mode listens on all interfaces, which could expose the host environment if not properly restricted.
[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary repository data (code, documentation, and configuration) to provide context to an LLM. This creates a surface for indirect prompt injection if an attacker places malicious instructions inside project files that are subsequently bundled and processed by the model.
Ingestion points: Local files and directories specified via the --file argument in SKILL.md (e.g., src/**, README.md).
Boundary markers: The documentation does not specify the use of delimiters or strict markers to isolate ingested content from the primary prompt instructions.
Capability inventory: The oracle tool has the capability to read local files across the filesystem and perform network operations to send data to external AI providers.
Sanitization: There is no evidence of automated sanitization or filtering of external content; the instructions rely on the user to manually "avoid secrets."

oracle