Security audit
Security checks for vulnerabilities and agentic risk
The data lookups match the stated purpose, but automatic setup executes unreviewed remote code and can introduce broader changes to agent skills.
Review the setup behavior before installing. Prefer a verified, preinstalled CLI with automatic skill synchronization disabled, and approve installation and account connection separately. OOMOL mediates the lookups and credentials. The remote installers and backend implementation remain unverified; the inspected skill does not establish malicious intent.
The supplied command does not search or read API Ninjas data. It executes an installer from an unrelated domain, with no demonstrated connection to the declared functionality. The downloaded script's further behavior cannot be determined from this chunk.
The supplied command performs login rather than an API Ninjas search or data read. Authentication could be a supporting implementation detail if linked to the declared service, but the supplied chunk establishes no such link and contains no API Ninjas functionality.
The curl-to-bash command executes a mutable remote script with the agent process's privileges, without an independently verified integrity check or review step; the PowerShell alternative has the same problem. Compromise of the distribution endpoint or installer supply chain could enable local data theft or host modification, although the supplied content does not establish that the endpoint is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-CLI error, the workflow directs the agent to execute a remote installer without explicitly obtaining approval for local software installation or explaining its system effects. This extends a data-reading task into host modification; the conditional trigger reduces frequency but does not establish user consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources