Security audit
Security checks for vulnerabilities and agentic risk
The Apiframe integration is coherent, but its setup instructions execute an unverified remote installer without a separate approval step.
Review and install a verified CLI release separately before enabling this skill. Check its automatic skill synchronization settings and permit only the connected accounts you intend to use. Requests pass through OOMOL, and generation can consume credits. The bundled instructions were fully reviewed, but the remote installer and live service implementation were not verified.
The supplied command runs an Oomol installer, with no demonstrated connection to Apiframe. Nothing in the chunk establishes this installation as a supporting dependency for the declared functionality. The downloaded script's contents are not supplied, so its additional effects cannot be determined.
Piping an unpinned HTTPS response directly into bash executes whatever the installation endpoint supplies, without independently verifying its integrity or reviewing it first. Compromise of the distribution endpoint or release process could therefore execute attacker-controlled code with the agent's local permissions; the PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute downloaded installation code without explaining the host-level effects or requesting installation-specific approval. Although this is legitimate dependency setup, it crosses from Apiframe operations into local software execution; the declared Bash(oo *) restriction may limit execution if enforced, but does not make the setup instructions safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources