Security audit
Security checks for vulnerabilities and agentic risk
The documentation features fit the stated purpose, but setup directs the agent to execute unverified remote installers without a clear approval step.
Review setup before enabling this skill. Install and verify the CLI yourself, or require approval before the agent runs either installer. Documentation requests use your OOMOL-connected account and may incur charges. The external installers were unavailable for inspection, so their system changes remain unverified.
The supplied command runs an Oomol-hosted installer, with no visible Context7 interaction or demonstrated connection to the declared functionality. On the supplied evidence, this is an undeclared installation capability rather than an established supporting implementation detail. The downloaded script's further behavior is not available for assessment.
Authentication can be a supporting implementation detail, but the supplied chunk consists solely of a login command and does not establish that it supports Context7 access. Its demonstrated purpose therefore differs materially from the declared Context7 search-and-read functionality.
Piping an unpinned HTTPS response directly into bash executes whatever the installation endpoint serves, without independent integrity verification or review. Compromise of the distribution endpoint or release pipeline could therefore execute attacker-controlled code with the invoking user's permissions; the PowerShell fallback has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation of executable software without explicitly requiring approval for local system changes or explaining that downloaded code will run with the invoking user's permissions. Restricting this to a missing-CLI error reduces exposure, but a documentation lookup should not implicitly authorize software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources