Security audit
Security checks for vulnerabilities and agentic risk
The Harmonic integration fits its purpose, but its setup instructions can execute downloaded software without clear user approval or limits on local changes.
Review and approve CLI installation separately before allowing this skill to perform setup. Use a verified release, check which agent skills it installs, and connect only the intended Harmonic account. OOMOL mediates requests and credentials. The concern is insufficient control over dependency installation; the inspected artifact does not establish malicious intent.
The supplied chunk performs remote software installation, not Harmonic.ai search or data retrieval. Nothing shown establishes that this installer is a supporting dependency for the declared functionality. The downloaded script's contents are unavailable, so its additional effects cannot be determined.
The command pipes a remotely fetched, unpinned installer directly into Bash; the Windows alternative similarly evaluates downloaded code. If the distribution endpoint or release infrastructure is compromised, attacker-controlled code could run with the agent process's permissions and access local files or credentials; HTTPS and the legitimate integration purpose do not establish artifact integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to install software without first obtaining approval for local system changes. Although this fallback is conditional and relevant to the integration, authorization to read Harmonic.ai data does not necessarily authorize installing and executing software on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources