oracle
Warn
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @steipete/oracleto automatically download the Oracle package from the public npm registry at runtime. - [REMOTE_CODE_EXECUTION]: By invoking
npx, the skill executes code fetched from a remote source, which is not part of the established trusted vendor list. - [COMMAND_EXECUTION]: The instructions direct the AI agent to execute multiple shell commands to interface with the external Oracle CLI tool.
- [DATA_EXFILTRATION]: The core functionality of the skill involves reading local repository files and sending their contents to external AI models (browser-based or via API). While this is the intended use case, it represents a deliberate export of local codebase data to third-party infrastructure.
Audit Metadata