Security audit
Security checks for vulnerabilities and agentic risk
The ActiveTrail actions have clear approval controls, but setup executes unverified downloads and under-discloses broader changes to agent instructions.
Review and install the CLI separately before allowing this skill to run. Consider disabling its startup skill synchronization using the control documented in the [CLI reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Understand that OOMOL mediates access to your ActiveTrail contacts, and retain approval for changes and deletions. The downloaded installers' exact behavior remains unverified.
The supplied code invokes an Oomol installer rather than performing ActiveTrail operations. Nothing in the chunk establishes that this installation supports ActiveTrail functionality. The remote script's contents are not provided, so its further effects cannot be determined.
The command pipes a mutable network response directly into bash without checking a pinned version, trusted signature, or independently supplied digest; the PowerShell alternative uses the same fetch-and-execute pattern. Compromise of the distribution endpoint could therefore execute arbitrary code with the invoking user's permissions, although the missing-CLI condition limits when this exposure occurs.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs execution of remote shell or PowerShell code without requiring separate user approval or explaining that installation can modify the local environment. Although conditional on a missing CLI, this expands an ActiveTrail data task into local code execution with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources