Security audit
Security checks for vulnerabilities and agentic risk
The Adyntel features match the stated purpose, but setup directs the agent to execute a remote installer without a clear approval or verification step.
Review and approve CLI installation separately before enabling this skill, preferably using a pinned release with authenticated integrity verification. Expect Adyntel queries and account access to pass through OOMOL. The remote installers were unavailable for inspection, so their system changes remain uncertain; no malicious behavior was established in the bundled artifact.
The supplied code installs remote software instead of searching or reading Adyntel data. Nothing in the chunk establishes this installation as a supporting dependency for Adyntel functionality. The downloaded script's contents and further effects are not shown.
The supplied chunk performs only a login operation; it contains no Adyntel search or read behavior. Authentication could be a supporting implementation detail if the CLI were established as an Adyntel client, but the supplied content provides no such connection.
Piping an HTTPS response directly into bash executes mutable remote content without a pinned version, signature check, or opportunity to inspect the complete script first. A compromised installer endpoint could therefore execute arbitrary commands under the agent's local account; this is the same underlying installation risk identified by SQP-2, not a separate exploit chain.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without an explicit installation approval step or integrity verification. If the installer source or delivery infrastructure is compromised, that code could access local files and credentials or modify the system with the invoking user's privileges; the missing-CLI condition limits exposure but does not remove the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources