Security audit
Security checks for vulnerabilities and agentic risk
This data-search skill needs review because it directs the agent to run an unverified remote installer when required software is missing.
Review and explicitly approve the CLI installation separately before allowing this skill to install software. Prefer a verified, pinned release and check whether it installs additional agent skills. Using the connector also entrusts OOMOL with your connected Gildata access. The review concern is uncontrolled setup execution; the inspected artifact does not establish malicious behavior.
The supplied code performs an external CLI installation rather than searching or reading Gildata Data Map. Although installation can be a supporting implementation detail, nothing supplied establishes that this installer supports the declared purpose. The downloaded script is not included, so its additional behavior and permissions cannot be determined.
Piping the downloaded script directly into Bash executes mutable remote content without a pinned version or independent integrity verification. A compromised installation host or release pipeline could therefore execute attacker-controlled commands with the user's permissions; HTTPS protects transport but does not establish that the delivered script is trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-command error, the workflow directs the agent to execute a remote installer without first explaining the local changes or requesting explicit installation approval. Installing software exceeds the normal scope of reading financial data and can execute arbitrary code with the invoking user's permissions; the error-triggered fallback limits exposure but does not provide informed consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources