Security audit
Security checks for vulnerabilities and agentic risk
The Countly features fit their purpose, but setup can execute unverified installers and introduce persistent changes to agent skills without clear user control.
Review setup before installing. Prefer a separately reviewed CLI version, approve its local changes, and disable unwanted automatic skill synchronization. Connect only the Countly account and applications needed. The installer and hosted connector were not verified; the evidence supports a setup-control concern, not demonstrated malicious behavior.
The setup fallback directs the agent to download and execute installation code, expanding a read-oriented Countly task into local software installation without explicit user approval. Using OOMOL is consistent with the declared connector architecture and is not itself suspicious; the risk is the unreviewed installer execution, which overlaps with SQP-2 and SC2.
Piping the HTTPS installer directly into bash executes whatever the endpoint returns without version pinning or independent integrity verification. HTTPS protects transport but not a compromised publisher or distribution endpoint, so this fallback could execute attacker-controlled code with the agent process's permissions.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Both setup commands execute remotely supplied code immediately, without review, integrity verification, or a user confirmation step explaining local changes. The missing-CLI condition limits when this happens but does not prevent a compromised installer from accessing files or modifying the environment with the executing user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Countly homepage: https://countly.com/
- API documentation: https://api.count.ly/reference/rest-api-reference