Security audit
Security checks for vulnerabilities and agentic risk
The BaseLinker reads fit the skill’s purpose, but its automatic setup instructions execute unverified remote code without clearly separating installation approval.
Review and approve the CLI installation separately before enabling this skill’s setup fallback. Consider disabling its documented cross-agent skill synchronization if unwanted, and connect only the intended BaseLinker account through OOMOL. The package contains only instructions; the remote installers and hosted connector implementation were not verified. No artifact-backed malicious intent was found.
The supplied command installs remote software rather than searching or reading BaseLinker data. No BaseLinker operations or evidence that this installation is a necessary supporting dependency are present. The downloaded script's contents are unavailable, so its further behavior cannot be determined.
Piping a remotely fetched script directly into bash executes mutable network-delivered code with the agent process's local privileges, without prior inspection or independent integrity verification. A compromised distribution endpoint could therefore cause credential theft or local tampering; the PowerShell fallback has the same issue, although setup is conditional and the declared tool allowlist may block these commands if enforced.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs an agent to install software by executing downloaded scripts without first explaining the local system changes or obtaining installation approval. Restricting setup to a missing-CLI error reduces exposure, but a request to read BaseLinker data does not itself authorize local software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- BaseLinker homepage: https://baselinker.com
- API documentation: https://api.baselinker.com/