Security audit
Security checks for vulnerabilities and agentic risk
The Coinranking reading workflow is coherent, but its automatic setup executes unverified downloaded code and needs review.
Before use, install a pinned, integrity-verified CLI yourself and prevent automatic execution of the fallback installers. Review the CLI's bundled-skill synchronization; its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables) documents OO_SKILLS_SYNC_DISABLED for disabling startup synchronization. OOMOL handles provider credentials, and calls may consume credit. This review did not verify the external installer contents or hosted connector implementation.
The supplied command performs remote script execution, not Coinranking data retrieval. Nothing in the supplied chunk establishes this installer as a necessary supporting implementation detail for the declared purpose. The downloaded script's contents and further effects are unknown.
The supplied chunk performs only CLI authentication, with no Coinranking-specific search or data-reading behavior. Authentication could support an integration, but nothing in this chunk establishes that connection. As supplied, its behavior does not match the declared purpose.
The curl-to-bash pipeline executes the live contents of an external URL without verifying a pinned artifact or reviewing the script. HTTPS protects transport but not against a compromised publisher or hosting account, making this a supply-chain execution risk rather than evidence of an intentionally malicious destination.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs immediate execution of remotely retrieved shell or PowerShell code without integrity verification, review, or explicit installation approval. A compromised installation endpoint or delivery pipeline could execute attacker-controlled code with the agent process's permissions; triggering only when the CLI is missing reduces exposure but does not make execution safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources