Security audit
Security checks for vulnerabilities and agentic risk
The WHOIS functions fit the stated purpose, but automatic setup executes unverified installers and does not disclose broader changes to agent skills.
Review the setup behavior before installing. Prefer installing a reviewed CLI version yourself, require approval for dependency installation, and review or disable automatic skill synchronization using the publisher's documented controls. OOMOL mediates lookup requests and connected credentials, and usage may incur charges. No malicious payload was established, but the remote installers remain unverified.
The supplied command performs remote software installation, not IP2WHOIS searching or data retrieval. Nothing in the supplied content establishes that installing the Oomol CLI is a supporting dependency for the declared purpose. The downloaded script is not provided, so its additional effects cannot be determined.
The supplied code only initiates login; it does not search or read IP2WHOIS data. Authentication could be a supporting implementation detail if tied to the declared service, but the supplied chunk establishes no such connection.
Piping the HTTPS response directly into bash executes mutable remote code without a review or integrity-verification step. HTTPS protects transport but not against a compromised hosting or release pipeline, so this setup step could expose local files, credentials, and the agent's execution environment.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without integrity verification or explicit approval for installing software. A compromised installer endpoint or publishing pipeline could execute arbitrary commands with the agent's local privileges; the missing-CLI condition limits exposure but does not reduce that potential impact.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources