Security audit
Security checks for vulnerabilities and agentic risk
The skill reads Metronome data as advertised, but its fallback setup executes unverified software from the internet without a separate approval step.
Review the setup before installing. Prefer a reviewed, version-pinned CLI installation and require approval for local installation or agent-skill changes. Connecting Metronome gives OOMOL access to sensitive billing information. The external installers are not bundled and could not be retrieved, so their exact local effects remain uncertain.
The supplied command installs or bootstraps software from an unrelated service, and no Metronome functionality is shown. This is materially different from the declared data-search and reading purpose, not an established supporting implementation detail. The downloaded script's further behavior cannot be determined from this chunk.
Piping an HTTPS response directly into bash executes mutable remote content with the agent's local privileges, without a review or integrity-verification step. A compromised distribution endpoint or malicious installer update could therefore execute arbitrary commands and access local data; the PowerShell alternative has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software and execute remote code without first obtaining approval for local system changes. Although conditional on the CLI being missing, this expands a read-only Metronome request into a potentially consequential installation operation without informed user consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources