Security audit
Security checks for vulnerabilities and agentic risk
The Circle reading features fit their purpose, but setup instructs the agent to execute an unverified remote installer without clearly requiring your approval.
Review setup before enabling this skill. Install a reviewed CLI version yourself and require approval for installation or changes to other agent skills. Confirm that OOMOL may handle your Circle data. The Circle instructions are coherent, but the remote installer and live connector implementation could not be verified.
The supplied command performs remote installer execution, not Circle searching or reading. Nothing in the supplied chunk establishes that this installation supports the declared Circle functionality. The installer’s contents are unavailable, so its further effects cannot be determined.
The command immediately executes a mutable, remotely hosted script without version pinning or independent integrity verification; the PowerShell alternative follows the same pattern. If the distribution endpoint or publishing pipeline is compromised, attacker-controlled code could execute with the agent's local permissions, exposing accessible files and credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software without first explaining system changes or obtaining explicit approval, expanding a Circle read request into local code execution. The missing-CLI condition limits exposure, but does not make installation an authorized consequence of a data-reading task.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Circle homepage: https://circle.so
- API documentation: https://api.circle.so/apis/admin-api/quick-start