技能 intelligent-oracle
📦
intelligent-oracle
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取🔑 環境變數
部署 GenLayer 預言機市場
建立預言機市場需要嚴格遵循欄位、來源規則及合約呼叫要求。此技能可草擬、部署、驗證及監控 GenLayer Intelligent Oracle 市場。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "intelligent-oracle" from https://skillstore.io/skills/internet-court-intelligent-oracle.md and its manifest at https://skillstore.io/api/skills/internet-court-intelligent-oracle/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「intelligent-oracle」。 Bitcoin 在 2026 年底的收盤價是否會高於指定價格？
預期結果:
簡潔的市場標題、是或否結果集、以 Binance 作為價格來源，以及晚於事件發生時間的裁定日期。
正在使用「intelligent-oracle」。 檢查我已部署的預言機是否已完成。
預期結果:
聚焦於狀態的回應，說明預言機是運作中、已裁定或發生錯誤，並提供關鍵位址及標題。
正在使用「intelligent-oracle」。 為未來的錦標賽結果建立體育市場。
預期結果:
使用體育資訊來源、明確獲勝規則，以及晚於決賽日期的二元市場草案。
安全審計
高風險v2 • 2026/7/21 開啟版本化報告
Most external-command alerts are false positives caused by Markdown code delimiters and TypeScript syntax. The skill genuinely performs network access, handles private keys, can run a deployment command, and trusts remotely hosted configuration and source-policy data. Remote factory metadata can redirect a signed deployment unless the returned address and transaction are independently verified.
1
已掃描檔案
362
分析行數
21
複核項目
0
已忽略的誤報
已確認的安全問題 (6)
高
Environment file access
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
高
Environment file access
account: createAccount(process.env.PRIVATE_KEY),
The Node example accesses PRIVATE_KEY to sign transactions. This is a legitimate use, but it is sensitive credential handling and requires explicit user control.
高
Environment file access
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
高
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The fork deployment flow writes a new factory address to .env.local. This alters a configuration file that can influence later deployments and should be reviewed by the user.
高
Remote Factory Pointer Can Redirect Signed Deployment
The workflow fetches a factory address from a remote metadata endpoint before deployment. If that endpoint is compromised, an agent could prepare a signed transaction for an attacker-selected contract unless the user reviews the address and call details.
The instructions explicitly trust a remotely fetched factoryAddress and then direct deployment to that factory. The source provides no integrity verification or required user confirmation of the returned address.
中
Unpinned External Source Catalog Influences Market Evidence
The skill treats a live external source catalog as authoritative for blocked and rerouted hosts. Changes to that catalog can alter source selection and market settlement behavior without local review.
The text explicitly requires use of a mutable remote catalog for source blocking and rerouting. This is a business-logic trust dependency rather than merely a hardcoded URL.
能力複核項目 (21)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Environment variable access (dot notation)
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Environment variable access (dot notation)
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Environment variable object
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Environment variable object
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Generic API/secret keys
// Node: createAccount(process.env.PRIVATE_KEY). If PRIVATE_KEY is unset,
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Generic API/secret keys
account: createAccount(process.env.PRIVATE_KEY),
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
高
Generic API/secret keys
cd scripts && PRIVATE_KEY=<key> RPC_URL=<rpc> npm run deploy
The documented deployment path reads PRIVATE_KEY from the environment to create a signing account or runs a command with credential variables. A compromised execution path could expose or misuse the key.
中
Ruby/shell backtick execution
- Use the `genlayer-js` SDK from another runtime via a Node subprocess, or
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
中
Ruby/shell backtick execution
```bash
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
中
Ruby/shell backtick execution
```
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
中
Ruby/shell backtick execution
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The skill explicitly directs agents to run a Node subprocess or a shell deployment command. Executing it can install or run project code and, for deployment, use supplied credentials.
低
Hardcoded URL
GET https://intelligentoracle.com/oracle-meta.json
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
"rpcUrl": "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
If unreachable, default to `rpcUrl: "https://studio.genlayer.com/api"` and ask the user to paste the
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
| `dataSourceDomains` | `string[]` | Either this OR `resolutionURLs` is populated, never both, never
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
- **Never invent a source.** If the user supplies a specific source domain or URL, use it. Otherwise
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
The live verified catalog lives at `https://gym.genlayer.foundation/api/benchmarks/sources-bench/sou
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
endpoint: "https://studio.genlayer.com/api",
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
The RPC endpoint (`https://studio.genlayer.com/api`) speaks an Ethereum-style JSON-RPC superset. Rea
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
- `Factory address is not configured` — fetch `https://intelligentoracle.com/oracle-meta.json` or as
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
低
Hardcoded URL
This skill is published at `https://intelligentoracle.com/skill.md`. If you suspect it's stale, refe
The skill instructs network access to this endpoint as part of configuration, RPC use, source selection, or freshness checks. These requests are functional but expand the trust boundary.
風險因素
⚙️ 外部命令 (50)
SKILL.md:8 SKILL.md:14 SKILL.md:16 SKILL.md:17 SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-36 SKILL.md:36-38 SKILL.md:38 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70 SKILL.md:79 SKILL.md:80-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-101 SKILL.md:101-112 SKILL.md:112-118 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121-122 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-135 SKILL.md:135 SKILL.md:141-155 SKILL.md:155-159
🌐 網路存取 (10)
審計單位: claude 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/internet-court-intelligent-oracle?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/internet-court-intelligent-oracle?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-intelligent-oracle/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/internet-court-intelligent-oracle.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
internet-court. (2026). intelligent-oracle security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2BibTeX 引用
@techreport{internet-court-internet-court-intelligent-oracle-2026,
author = {internet-court},
title = {intelligent-oracle security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "intelligent-oracle security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-intelligent-oracle/audits/2"
identifiers:
- type: other
value: "skillstore:internet-court-intelligent-oracle:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
85
內容
65
社群
83
規範符合度
你可以打造什麼
建立市場草案
根據以自然語言描述的事件構想，建立有效的是或否市場設定。
部署測試預言機
使用 Studionet 部署步驟建立並驗證 GenLayer 預言機合約。
監控裁定狀態
在預言機啟動後進行檢查，並瞭解其狀態為運作中、已裁定或發生錯誤。
試試這些提示
草擬基本市場
草擬一個關於 [event] 的是或否預言機市場。使用可靠的公開來源，並選擇未來的裁定日期。
完善市場規則
完善此市場的裁定規則：[market summary]。保持恰好兩種結果，並說明選擇該來源的原因。
準備部署
檢查此預言機市場是否已準備好部署。檢查欄位、來源網域及最早裁定日期。
監控並裁定
根據預言機位址 [address]，概述用於驗證部署、監控狀態，以及在符合資格的日期後觸發裁定的檢查項目。
最佳實務
- 執行任何部署或裁定寫入操作前，確認每項操作。
- 僅在使用者提供穩定頁面時使用固定 URL。
- 僅記錄交易雜湊、預言機位址及必要的狀態欄位。
避免
- 請勿建立具有兩種以上可能結果的市場。
- 請勿在同一設定中混用裁定 URL 與來源網域。
- 除非使用者明確核准，否則請勿讀取私密金鑰。
常見問題
此技能會建立什麼？
它會建立 GenLayer Intelligent Oracle 預測市場草案及部署工作流程。
它需要有資金的金鑰嗎？
此技能預設使用 Studionet，其文件將其描述為可免費用於測試。
它可以支援三種或更多結果嗎？
不支援。文件記載的預言機設定要求恰好兩種不同的結果。
它可以使用任何網站作為證據嗎？
它會優先使用經驗證的來源網域，並可在使用者提供固定 URL 時使用這些 URL。
它會自動裁定市場嗎？
不會。此技能會說明必須在最早裁定日期後進行 resolve 呼叫。
使用者應審慎核准哪些操作？
使用者應審慎核准網路呼叫、私密金鑰使用、合約部署、裁定呼叫及環境檔案變更。
開發者詳細資訊
授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
3f6e026a3363e0954ede7bef0cfe88d4475de137
維護新鮮度
2026/7/21
使用量
1 次下載 · 0 次瀏覽
檔案結構
📄 SKILL.md