Security audit
Security checks for vulnerabilities and agentic risk
The Adyen read workflow is coherent, but its automatic setup can execute unverified remote code without clear user approval.
Review and install the CLI yourself before enabling this skill, including any additional agent skills it installs. Require approval for subsequent software installation and connect only the Adyen account permissions needed. Remote installer and hosted connector implementations were unavailable for verification; no malicious behavior was established in the submitted artifact.
The supplied command does not demonstrate any Adyen-related functionality. Instead, it executes an externally hosted installer, an undeclared capability with potential local system effects. Nothing in the supplied chunk establishes that this installation is a supporting implementation detail for Adyen access. The remote script's contents and precise effects are not available for inspection.
Piping a live HTTPS response directly into Bash executes mutable remote code without independent integrity verification or an opportunity to inspect it. Compromise of the installer distribution infrastructure could yield arbitrary execution with the invoking process's privileges; the PowerShell example has the same weakness, although both paths are limited to first-time setup.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software without first obtaining approval for local system changes and remote code execution. Although conditional setup reduces exposure, authorization to read Adyen data does not necessarily authorize running an installer with the agent's local privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources