Security audit
Security checks for vulnerabilities and agentic risk
The AlgoDocs integration is coherent, but its setup can execute an unverified online installer without first obtaining clear user approval.
Review the setup before installing. Prefer a separately verified CLI installation and control whether it may install or update other agent skills. Understand that OOMOL mediates access to your connected AlgoDocs account. The downloaded installers were unavailable for inspection; no malicious payload or unrelated data transfer was established.
The supplied command runs an Oomol-hosted installer, with no demonstrated connection to AlgoDocs. Although dependency installation can be a supporting implementation detail, the supplied chunk establishes no such relationship. The remote script's contents and further effects are not available for assessment.
Piping a remotely fetched installation script directly into Bash executes mutable network content with the agent process's local permissions, without an integrity check or review. A compromised distribution endpoint could therefore compromise accessible files or credentials; the analogous PowerShell command has the same issue, although both paths are conditional on the CLI being absent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to install software after a missing-command error without requiring explicit approval or explaining that downloaded code will execute locally. The error-triggered condition limits exposure, but a routine AlgoDocs request could still lead to host changes beyond the user's requested data operation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- AlgoDocs homepage: https://algodocs.com
- API documentation: https://api.algodocs.com/