Security audit
Security checks for vulnerabilities and agentic risk
The Blocknative lookups fit the stated purpose, but setup can execute unverified downloaded code without a clear user approval step.
Review the setup before enabling automatic use. Require approval before downloaded installer code runs, verify the CLI release, and decide whether its automatic agent-skill synchronization is acceptable. The complete bundled artifact was inspected, but the remote installers remain unverified; no malicious behavior was established.
The supplied command installs or executes third-party software rather than searching or reading Blocknative data. Nothing in the supplied chunk establishes this installer as a supporting dependency for Blocknative functionality. The downloaded script's contents and subsequent effects are not visible.
The command pipes a remotely fetched, unpinned script directly into Bash without integrity verification or an opportunity to inspect it; the PowerShell alternative has the same weakness. If the distribution endpoint or its delivery pipeline is compromised, attacker-controlled code would execute with the invoking user's permissions, potentially exposing local files and credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software without explicitly obtaining approval or explaining that downloaded code will execute and may modify the local system. Although conditional on a missing dependency, this crosses from a read-only data task into local code execution without a clear authorization boundary.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources