Security audit
Security checks for vulnerabilities and agentic risk
The data-reading workflow is coherent, but its setup can execute unverified online code without a clear approval step.
Review and approve CLI installation separately, preferably using a fixed, verified release. Consider whether you want its automatic skill synchronization; the documented OO_SKILLS_SYNC_DISABLED setting can disable it. OOMOL brokers your EODHD access and may charge for requests. The external installers and connector implementation remain unverified; the inspected artifact does not establish intentional harm.
The supplied command performs remote script execution rather than searching or reading EODHD data. No EODHD endpoint or EODHD-specific functionality appears in the code, and the description does not disclose installation of an unrelated CLI. The downloaded script's contents are not supplied, so its further effects cannot be determined.
The supplied chunk performs only a login operation; it does not search, read, or otherwise interact with EODHD APIs. Authentication could be a supporting implementation detail if the CLI were shown to provide EODHD access, but the supplied content establishes no such connection.
The command pipes a mutable network response directly into Bash without version pinning or independent integrity verification; the PowerShell alternative has the same execution pattern. If the distribution endpoint or delivery chain is compromised, attacker-controlled code could access local files and credentials or modify the environment, although the supplied content does not establish that the endpoint is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software by executing downloaded code without first obtaining approval for local system changes. Although conditional and relevant to setup, this expands a data-reading task into arbitrary code execution with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources