📦
Audit History
intelligent-oracle - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 03:21 AM
Most external-command alerts are false positives caused by Markdown code delimiters and TypeScript syntax. The skill genuinely performs network access, handles private keys, can run a deployment command, and trusts remotely hosted configuration and source-policy data. Remote factory metadata can redirect a signed deployment unless the returned address and transaction are independently verified.
1
Files scanned
362
Lines analyzed
30
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
High
Environment file access
account: createAccount(process.env.PRIVATE_KEY),
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
High
Environment file access
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
High
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
High
Remote Factory Pointer Can Redirect Signed Deployment
The workflow fetches a factory address from a remote metadata endpoint before deployment. If that endpoint is compromised, an agent could prepare a signed transaction for an attacker-selected contract unless the user reviews the address and call details.
The instructions explicitly trust a remotely fetched factoryAddress and then direct deployment to that factory. The source provides no integrity verification or required user confirmation of the returned address.
Medium
Unpinned External Source Catalog Influences Market Evidence
The skill treats a live external source catalog as authoritative for blocked and rerouted hosts. Changes to that catalog can alter source selection and market settlement behavior without local review.
The text explicitly requires use of a mutable remote catalog for source blocking and rerouting. This is a business-logic trust dependency rather than merely a hardcoded URL.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (dot notation)
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable access (dot notation)
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable object
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Environment variable object
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
High
Generic API/secret keys
cd scripts && PRIVATE_KEY=<key> RPC_URL=<rpc> npm run deploy
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
Medium
Ruby/shell backtick execution
- Use the `genlayer-js` SDK from another runtime via a Node subprocess, or
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
```bash
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
```
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Medium
Ruby/shell backtick execution
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
Low
Hardcoded URL
GET https://intelligentoracle.com/oracle-meta.json
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
"rpcUrl": "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
If unreachable, default to `rpcUrl: "https://studio.genlayer.com/api"` and ask the user to paste the
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
| `dataSourceDomains` | `string[]` | Either this OR `resolutionURLs` is populated, never both, never
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
- **Never invent a source.** If the user supplies a specific source domain or URL, use it. Otherwise
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
The live verified catalog lives at `https://gym.genlayer.foundation/api/benchmarks/sources-bench/sou
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
endpoint: "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
The RPC endpoint (`https://studio.genlayer.com/api`) speaks an Ethereum-style JSON-RPC superset. Rea
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
- `Factory address is not configured` — fetch `https://intelligentoracle.com/oracle-meta.json` or as
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Low
Hardcoded URL
This skill is published at `https://intelligentoracle.com/skill.md`. If you suspect it's stale, refe
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
Risk Factors
⚙️ External commands (50)
SKILL.md:8 SKILL.md:14 SKILL.md:16 SKILL.md:17 SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-36 SKILL.md:36-38 SKILL.md:38 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70 SKILL.md:79 SKILL.md:80-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-101 SKILL.md:101-112 SKILL.md:112-118 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121-122 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-135 SKILL.md:135 SKILL.md:141-155 SKILL.md:155-159
🌐 Network access (10)
🔑 Env variables (7)
Audited by: claude
Jul 10, 2026, 12:05 AM
Most static Ruby backtick findings are Markdown false positives, not executable shell constructs. Confirmed risks remain from external network calls, private-key environment access, .env.local modification, subprocess guidance, mutable remote refetching, and on-chain write operations.
1
Files scanned
362
Lines analyzed
25
Review items
0
False positives ignored
Confirmed security concerns (5)
High
Environment file access
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The deploy shortcut is documented as writing a new factory address to .env.local. Modifying environment configuration files is a real sensitive filesystem side effect.
High
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The deploy shortcut is documented as writing a new factory address to .env.local. Modifying environment configuration files is a real sensitive filesystem side effect.
High
Side-Effecting Oracle Deployment
The skill directs agents to call create_new_prediction_market and resolve on a public RPC endpoint. These writes can deploy or resolve contracts and should require explicit approval before execution.
The workflow includes concrete writeContract calls for deployment and resolution. These are on-chain side effects, not passive documentation only.
High
Mutable Remote Skill Refetch
The skill tells agents to refetch its canonical version from intelligentoracle.com if it seems stale. Loading mutable remote instructions after installation can bypass marketplace review.
The instruction directly points to a remote skill.md and invites refetching. That creates a clear post-review instruction update path.
Medium
External Subprocess Workaround
The raw RPC section advises using the SDK from another runtime through a Node subprocess and describes shelling out to a Node script. This expands execution beyond reviewed text.
The text explicitly recommends a Node subprocess for agents outside JavaScript. The risk is contextual because no bundled script is present.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The deployment guidance references PRIVATE_KEY or RPC_URL values for account creation and deployment. These values can contain sensitive credentials and must not be read or logged without explicit user consent.
High
Generic API/secret keys
account: createAccount(process.env.PRIVATE_KEY),
The deployment guidance references PRIVATE_KEY or RPC_URL values for account creation and deployment. These values can contain sensitive credentials and must not be read or logged without explicit user consent.
High
Generic API/secret keys
cd scripts && PRIVATE_KEY=<key> RPC_URL=<rpc> npm run deploy
The deployment guidance references PRIVATE_KEY or RPC_URL values for account creation and deployment. These values can contain sensitive credentials and must not be read or logged without explicit user consent.
Medium
Ruby/shell backtick execution
- Use the `genlayer-js` SDK from another runtime via a Node subprocess, or
Although the scanner matched Markdown backticks, this line also advises using a Node subprocess from another runtime. That is real external execution guidance and should require explicit user approval.
Medium
Hardcoded URL
This skill is published at `https://intelligentoracle.com/skill.md`. If you suspect it's stale, refe
The skill tells agents to refetch a mutable remote skill document if it seems stale. That is a real network dependency that can change behavior outside the audited file.
Low
Hardcoded URL
GET https://intelligentoracle.com/oracle-meta.json
The skill instructs agents to fetch oracle metadata from intelligentoracle.com. This is intentional outbound network access to an external service.
Low
Hardcoded URL
"rpcUrl": "https://studio.genlayer.com/api",
The hardcoded GenLayer Studio RPC endpoint is used for contract reads and writes. This is intentional outbound network access and can perform external side effects.
Low
Hardcoded URL
If unreachable, default to `rpcUrl: "https://studio.genlayer.com/api"` and ask the user to paste the
The hardcoded GenLayer Studio RPC endpoint is used for contract reads and writes. This is intentional outbound network access and can perform external side effects.
Low
Hardcoded URL
- **Never invent a source.** If the user supplies a specific source domain or URL, use it. Otherwise
The skill instructs agents to consult a live external catalog before choosing source domains. This is intentional outbound network access to mutable remote data.
Low
Hardcoded URL
The live verified catalog lives at `https://gym.genlayer.foundation/api/benchmarks/sources-bench/sou
The skill instructs agents to consult a live external catalog before choosing source domains. This is intentional outbound network access to mutable remote data.
Low
Hardcoded URL
endpoint: "https://studio.genlayer.com/api",
The hardcoded GenLayer Studio RPC endpoint is used for contract reads and writes. This is intentional outbound network access and can perform external side effects.
Low
Hardcoded URL
The RPC endpoint (`https://studio.genlayer.com/api`) speaks an Ethereum-style JSON-RPC superset. Rea
The hardcoded GenLayer Studio RPC endpoint is used for contract reads and writes. This is intentional outbound network access and can perform external side effects.
Low
Hardcoded URL
- `Factory address is not configured` — fetch `https://intelligentoracle.com/oracle-meta.json` or as
The skill instructs agents to fetch oracle metadata from intelligentoracle.com. This is intentional outbound network access to an external service.
Low
Environment variable access (dot notation)
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The example accesses process.env.PRIVATE_KEY for account creation. Environment-variable access is real here, and the higher-risk private-key exposure is covered by the secret-key findings.
Low
Environment variable access (dot notation)
account: createAccount(process.env.PRIVATE_KEY),
The example accesses process.env.PRIVATE_KEY for account creation. Environment-variable access is real here, and the higher-risk private-key exposure is covered by the secret-key findings.
Low
Environment variable object
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The example accesses process.env.PRIVATE_KEY for account creation. Environment-variable access is real here, and the higher-risk private-key exposure is covered by the secret-key findings.
Low
Environment variable object
account: createAccount(process.env.PRIVATE_KEY),
The example accesses process.env.PRIVATE_KEY for account creation. Environment-variable access is real here, and the higher-risk private-key exposure is covered by the secret-key findings.
Risk Factors
⚙️ External commands (50)
SKILL.md:8 SKILL.md:14 SKILL.md:16 SKILL.md:17 SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-36 SKILL.md:36-38 SKILL.md:38 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70 SKILL.md:79 SKILL.md:80-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-101 SKILL.md:101-112 SKILL.md:112-118 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121-122 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-135 SKILL.md:135 SKILL.md:141-155 SKILL.md:155-159
🌐 Network access (10)
🔑 Env variables (7)
Audited by: codex