Security audit
Security checks for vulnerabilities and agentic risk
Chargeblast actions have clear safeguards, but setup can execute unverified remote code and make broader agent changes without clear user approval.
Review the setup before installing. Install a verified CLI release yourself, approve its local changes, and review or disable automatic agent-skill synchronization. Connecting Chargeblast gives OOMOL access to the connected account; keep permissions limited and retain confirmation for credit requests and alert updates. The remote installer and hosted implementation were not verified.
The supplied code installs or bootstraps software from Oomol rather than interacting with Chargeblast. No connection establishing this as a supporting Chargeblast implementation detail is provided. The downloaded script's contents are unavailable, so its additional behavior cannot be determined.
Piping a mutable HTTPS download directly into bash executes whatever the installation endpoint returns with the invoking user's privileges, without first checking its integrity or contents. The endpoint is relevant to the documented CLI dependency, but compromise of its delivery infrastructure could expose local files, credentials, and account access; the PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the workflow directs installation through remotely downloaded shell or PowerShell code without an explicit approval checkpoint or explanation of local changes. Conditional setup reduces exposure, but a Chargeblast data request can still lead to local code execution beyond the user's apparent task scope.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources