Security audit
Security checks for vulnerabilities and agentic risk
The Amplitude features fit the stated purpose, but setup directs the agent to execute an unverified remote installer without an explicit approval step.
Review and install the CLI separately before enabling this skill, using a verified release and checking which agent skills it installs or updates. Connecting Amplitude entrusts OOMOL with credential handling and access to your analytics. The bundled instructions show no malicious behavior, but they do not establish the safety or exact changes of the remote installer.
The supplied command performs remote script execution for an Oomol CLI installer, not Amplitude data search or retrieval. Nothing in the chunk establishes that this installation supports the declared Amplitude functionality, and the installer’s downstream behavior is not visible.
Piping a downloaded script directly into bash executes mutable remote content without a pinned version, integrity verification, or review. A compromised distribution endpoint could execute arbitrary code with the agent's local privileges; the PowerShell alternative has the same issue, although the missing-CLI condition limits when this path is reached.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup fallback directs the agent to install software when the CLI is missing without requiring approval or explaining local system changes. Although conditional setup is appropriate for this connector, permission to read Amplitude data does not necessarily authorize executing an installer with the agent's local privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources