Security audit
Security checks for vulnerabilities and agentic risk
The Embase searches fit the stated purpose, but setup can execute unverified remote installers without a clear user approval step.
Review and install the CLI separately before using this skill. Require approval for installation, verify the release, and check its automatic agent-skill synchronization settings. Embase queries use your OOMOL-connected account; installer effects and the exact downloaded release remain unverified.
The supplied code performs remote script execution rather than Embase searching or reading. Although dependency installation can be a supporting implementation detail, this chunk provides no evidence that the external installer supports Embase functionality. The downloaded script's contents and further effects are not available for assessment.
The command pipes a mutable remote script directly into Bash without pinning or independently verifying its contents; the PowerShell alternative has the same weakness. If the script distribution infrastructure is compromised, attacker-controlled code could execute with the agent's privileges and access local files or credentials; HTTPS alone does not prevent this supply-chain scenario.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by executing remote scripts without first explaining the system changes or obtaining explicit approval. Although the missing-command condition limits exposure, a request to search Embase does not itself authorize arbitrary installer execution with the agent's operating-system privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources