consult-oracle
Warn
Audited by Snyk on Oct 23, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (low risk: 0.10). The skill automates consultation with ChatGPT via browser automation, ingesting responses from an external web service where the output is untrusted free text.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.70). The skill executes an arbitrary third-party npm package (
@steipete/oracle@latest) vianpxduring runtime without a verifiable repository locator or enforced digest, creating an unverifiable external runtime dependency under weak/unknown provenance.
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata