Oracle

Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).

This skill is largely documentation for the oracle CLI and installs via an npm package. Before installing or running it: 1) Verify the npm package owner (@steipete) and inspect the package contents or source repo if you don't already trust it. 2) Be aware SKILL.md references OPENAI_API_KEY and ORACLE_HOME_DIR even though they aren't declared — if you have these env vars set, the CLI may use them; ensure any API keys you have are appropriate for the intended runs. 3) Never attach secret files; the docs repeat this but the tool can upload attachments in browser mode — only include the minimal files needed and scrub secrets. 4) Avoid running the serve command bound to 0.0.0.0 on an Internet-exposed host; if you must accept remote connections, bind to loopback or place behind a firewall and use strong tokens. 5) Consider installing the CLI in an isolated environment (container or dedicated VM) if you will run it against sensitive repositories. If you want more assurance, provide the package source (repo or npm link) so it can be reviewed for unexpected behavior.

Type: OpenClaw Skill Name: prompt-bundler-oracle Version: 1.0.0 The skill describes a CLI tool ('oracle') for bundling local files and sending them to external LLM providers via API or browser automation. It possesses high-risk capabilities, including broad file system access (via globs), network communication, and a remote server mode ('oracle serve' on port 9473). While these features are consistent with the stated purpose of providing repository context to AI models, the inherent risk of data exfiltration and the reference to a non-existent 'GPT-5.2 Pro' model are concerning. The skill instructs the agent to install and execute an external Node package (@steipete/oracle) and manage sessions in '~/.oracle/sessions' (SKILL.md).