Skills intelligent-oracle
📦
intelligent-oracle
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables
Deploy GenLayer Oracle Markets
Creating an oracle market requires strict fields, source rules, and contract calls. This skill drafts, deploys, verifies, and monitors GenLayer Intelligent Oracle markets.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "intelligent-oracle" from https://skillstore.io/skills/internet-court-intelligent-oracle.md and its manifest at https://skillstore.io/api/skills/internet-court-intelligent-oracle/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "intelligent-oracle". Will Bitcoin close above a chosen price at the end of 2026?
Expected outcome:
A concise market title, a Yes or No outcome set, Binance as the price source, and a resolution date after the event.
Using "intelligent-oracle". Check whether my deployed oracle is finished.
Expected outcome:
A status-focused response that explains whether the oracle is active, resolved, or in error, with the key address and title.
Using "intelligent-oracle". Create a sports market for a future championship result.
Expected outcome:
A binary market draft using a sports source, clear winner rules, and a resolution date after the final match.
Security Audit
High Riskv2 • 7/21/2026 Open versioned report
Most external-command alerts are false positives caused by Markdown code delimiters and TypeScript syntax. The skill genuinely performs network access, handles private keys, can run a deployment command, and trusts remotely hosted configuration and source-policy data. Remote factory metadata can redirect a signed deployment unless the returned address and transaction are independently verified.
1
Files scanned
362
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
High
Environment file access
account: createAccount(process.env.PRIVATE_KEY),
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
High
Environment file access
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
High
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
High
Remote Factory Pointer Can Redirect Signed Deployment
The workflow fetches a factory address from a remote metadata endpoint before deployment. If that endpoint is compromised, an agent could prepare a signed transaction for an attacker-selected contract unless the user reviews the address and call details.
The instructions explicitly trust a remotely fetched factoryAddress and then direct deployment to that factory. The source provides no integrity verification or required user confirmation of the returned address.
Medium
Unpinned External Source Catalog Influences Market Evidence
The skill treats a live external source catalog as authoritative for blocked and rerouted hosts. Changes to that catalog can alter source selection and market settlement behavior without local review.
The text explicitly requires use of a mutable remote catalog for source blocking and rerouting. This is a business-logic trust dependency rather than merely a hardcoded URL.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (dot notation)
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable access (dot notation)
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable object
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable object
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
cd scripts && PRIVATE_KEY=<key> RPC_URL=<rpc> npm run deploy
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
Medium
Ruby/shell backtick execution
- Use the `genlayer-js` SDK from another runtime via a Node subprocess, or
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
```bash
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
```
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Low
Hardcoded URL
GET https://intelligentoracle.com/oracle-meta.json
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
"rpcUrl": "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
If unreachable, default to `rpcUrl: "https://studio.genlayer.com/api"` and ask the user to paste the
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
| `dataSourceDomains` | `string[]` | Either this OR `resolutionURLs` is populated, never both, never
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
- **Never invent a source.** If the user supplies a specific source domain or URL, use it. Otherwise
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
The live verified catalog lives at `https://gym.genlayer.foundation/api/benchmarks/sources-bench/sou
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
endpoint: "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
The RPC endpoint (`https://studio.genlayer.com/api`) speaks an Ethereum-style JSON-RPC superset. Rea
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
- `Factory address is not configured` — fetch `https://intelligentoracle.com/oracle-meta.json` or as
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
This skill is published at `https://intelligentoracle.com/skill.md`. If you suspect it's stale, refe
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Risk Factors
⚙️ External commands (50)
SKILL.md:8 SKILL.md:14 SKILL.md:16 SKILL.md:17 SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-36 SKILL.md:36-38 SKILL.md:38 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70 SKILL.md:79 SKILL.md:80-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-101 SKILL.md:101-112 SKILL.md:112-118 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121-122 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-135 SKILL.md:135 SKILL.md:141-155 SKILL.md:155-159
🌐 Network access (10)
🔑 Env variables (7)
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/internet-court-intelligent-oracle?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/internet-court-intelligent-oracle?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-intelligent-oracle/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/internet-court-intelligent-oracle.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
internet-court. (2026). intelligent-oracle security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2BibTeX citation
@techreport{internet-court-internet-court-intelligent-oracle-2026,
author = {internet-court},
title = {intelligent-oracle security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "intelligent-oracle security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2"
identifiers:
- type: other
value: "skillstore:internet-court-intelligent-oracle:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
85
Content
65
Community
83
Spec Compliance
What You Can Build
Launch a Market Draft
Create a valid Yes or No market configuration from a plain-language event idea.
Deploy a Test Oracle
Use Studionet deployment steps to create and verify a GenLayer oracle contract.
Monitor Resolution Status
Check an oracle after launch and understand whether it is active, resolved, or in error.
Try These Prompts
Draft a Basic Market
Draft a Yes or No oracle market about [event]. Use a reliable public source and choose a future resolution date.
Refine Market Rules
Tighten the resolution rules for this market: [market summary]. Keep exactly two outcomes and explain the source choice.
Prepare for Deployment
Review this oracle market for deployment readiness. Check fields, source domains, and the earliest resolution date.
Monitor and Resolve
Given oracle address [address], outline the checks to verify deployment, monitor status, and trigger resolution after the eligible date.
Best Practices
- Confirm every deployment or resolution write before executing it.
- Use fixed URLs only when the user provides stable pages.
- Log only transaction hashes, oracle addresses, and essential state fields.
Avoid
- Do not create markets with more than two possible outcomes.
- Do not mix resolution URLs and source domains in one config.
- Do not read private keys unless the user explicitly approves.
Frequently Asked Questions
What does this skill create?
It creates GenLayer Intelligent Oracle prediction market drafts and deployment workflows.
Does it require funded keys?
The skill defaults to Studionet, which is described as free for testing.
Can it support three or more outcomes?
No. The documented oracle configuration requires exactly two distinct outcomes.
Can it use any website as evidence?
It prefers verified source domains and can use fixed URLs when the user provides them.
Does it automatically resolve markets?
No. The skill explains that a resolve call must be made after the earliest resolution date.
What should users approve carefully?
Users should approve network calls, private-key use, contract deployment, resolution calls, and environment file changes.
Developer Details
Author
internet-courtLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
3f6e026a3363e0954ede7bef0cfe88d4475de137
Maintenance freshness
7/21/2026
Usage
1 downloads · 0 views
File structure
📄 SKILL.md