Security audit
Security checks for vulnerabilities and agentic risk
The skill’s account-reading functions fit its purpose, but its setup instructions can automatically run unverified downloaded software.
Install and verify the required CLI yourself before using this skill, and prevent automatic installer execution. Review the CLI’s bundled-skill installation behavior and the Lucid account access granted through OOMOL. The setup instructions warrant review, but the inspected artifact does not establish malicious intent; the downloaded installers remain unverified.
The supplied command does not access Lucid SCIM or perform data searches or reads. It fetches and executes an external installation script, with no demonstrated connection to the declared purpose. The downloaded script's exact behavior cannot be determined from this chunk.
The fallback pipes a mutable remote script directly into Bash without reviewing it or verifying a pinned artifact; the PowerShell alternative similarly executes downloaded content. If the distribution endpoint or publishing pipeline is compromised, the script could execute arbitrary code with the invoking user's privileges, although the missing-CLI condition limits exposure and there is no evidence of malicious intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources