The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/run_oracle.py utilizes npx -y @steipete/oracle@latest to download and execute an external package from the NPM registry during execution. This approach fetches code at runtime without version pinning or integrity verification, creating a potential vector for supply chain attacks if the external package is updated with malicious code.
[EXTERNAL_DOWNLOADS]: The skill triggers the download of the @steipete/oracle package from the public NPM registry. This dependency is fetched from an external source that is not listed as a trusted organization for the platform.
[COMMAND_EXECUTION]: The Python script scripts/run_oracle.py uses subprocess.call() to execute system commands. It specifically invokes the npx binary and passes arguments that include user-provided prompts and local file paths.
[INDIRECT_PROMPT_INJECTION]: The skill reads local project files and user prompts to be processed by an external LLM (the 'oracle'). This pattern introduces a vulnerability to indirect prompt injection.
Ingestion points: Content from files passed via the --file argument and the text provided in the --prompt argument are used as input (SKILL.md, Step 3).
Boundary markers: The instructions do not include specific delimiters or 'ignore embedded instructions' warnings to prevent the LLM from executing malicious commands found inside the processed project files.
Capability inventory: The skill has the ability to execute shell commands via the Python wrapper, write files to the .turbo/oracle directory, and perform network operations through the automated browser session.
Sanitization: There is no evidence of input validation or content filtering for the data ingested from files or prompts before it is sent to the external execution environment.

consult-oracle