oracle-soul-sync-update
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill fetches public, user-generated data from GitHub (Step 2: LATEST=$(curl -s https://api.github.com/repos/Soul-Brews-Studio/oracle-skills-cli/tags) and the "What's New" gh api/release commands) and uses those live values to decide whether to install/update code, so untrusted third-party content can directly influence tool actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill fetches the latest tag via https://api.github.com/repos/Soul-Brews-Studio/oracle-skills-cli/tags and then runs a bunx install that pulls and executes code from the GitHub package reference oracle-skills@github:Soul-Brews-Studio/oracle-skills-cli#$LATEST at runtime, so external repository content directly controls/executes code the skill relies on.
Audit Metadata