Security audit
Security checks for vulnerabilities and agentic risk
The Coresignal features fit their purpose, but setup directs the agent to run downloaded software without verification or a clear approval step.
Review and approve CLI installation separately before allowing the setup fallback, including any changes to installed agent skills. Prefer a fixed, independently verified release. Using the connector also means trusting OOMOL with Coresignal credentials and queries. The remote installers could not be retrieved, so their exact behavior remains unverified; the artifacts do not establish malicious intent.
The only supplied operation executes a remote installer, with no visible connection to the declared Coresignal functionality. The code does not establish that this is a supporting dependency for that functionality. The installer's downstream actions cannot be determined from the supplied chunk.
Piping the installer URL directly into bash executes mutable remote content without an opportunity to verify or review it first. A compromised hosting endpoint or installer supply chain could execute arbitrary commands, access local credentials, or modify files; HTTPS protects transport but does not establish that the script itself is trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software by immediately executing downloaded shell or PowerShell content, without explicit approval or integrity verification. This expands a data-reading task into local code execution with the invoking user's privileges; the conditional trigger and declared tool restrictions limit reachability but do not make the installation instructions safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources