Security audit
Security checks for vulnerabilities and agentic risk
The Certn functions match the stated purpose, but first-time setup can execute unverified downloaded code without clear user approval.
Review and install the CLI separately before using this skill, checking its integrity and any bundled skill changes. Use a narrowly scoped Certn connection and understand that OOMOL mediates sensitive records. The remote installers could not be inspected; their exact changes remain unknown. No artifact-backed malicious behavior was established.
The supplied command performs remote script execution rather than searching or reading Certn data. No Certn interaction or dependency relationship is shown that would establish this installation as a supporting implementation detail. The downloaded script's contents are not supplied, so its further behavior cannot be assessed.
The command pipes a remotely fetched, unpinned script directly into Bash; the Windows alternative similarly evaluates downloaded code immediately. If the distribution endpoint or release pipeline is compromised, arbitrary code could execute with the agent process's privileges and access local files or credentials; HTTPS alone does not establish artifact integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs installation without requiring user approval or explaining that downloaded code will execute and may modify the local system. Restricting this to first-time setup reduces frequency, but a request to read Certn data does not inherently authorize software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources