oracle
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install and run an external package
@steipete/oracleusingnpm install -gandnpx. This package is a third-party dependency not included in the platform's trusted vendor list. - [COMMAND_EXECUTION]: The skill uses shell commands to interact with the system, including creating temporary files (
/tmp/oracle-prompt.txt), executing the Oracle CLI tool with various flags, and reading local files likeplan.md. - [DATA_EXFILTRATION]: The primary function of the
@steipete/oracletool is to bundle codebase files (matching patterns likesrc/**,prisma/**, andconvex/**) and transmit them to a remote AI engine (referenced asgpt-5.2-codex) for analysis. This represents a transfer of potentially sensitive intellectual property to an external service.
Audit Metadata