Security audit
Security checks for vulnerabilities and agentic risk
The Minerstat functions fit the stated purpose, but setup directs the agent to execute an unverified online installer without a clear approval step.
Review and install a verified CLI release yourself before allowing agent use. Check its agent-skill synchronization settings because current CLI documentation describes changes beyond this Minerstat skill. Connecting Minerstat entrusts its API credential to OOMOL. The remote installers and hosted connector implementation were not verified; no artifact-backed evidence establishes malicious intent.
The supplied command performs remote script execution for an Oomol CLI installer, with no visible Minerstat interaction. Installing unrelated software is a materially different capability from the declared read/search purpose. The downloaded script's further behavior cannot be determined from this code chunk.
The supplied chunk only performs a login operation and contains no Minerstat search or data-reading behavior. Authentication could be a supporting implementation detail if linked to Minerstat access, but the supplied code establishes no such connection. The assessment does not assume which service oo authenticates to or whether login succeeds.
Piping an unpinned HTTPS download directly into Bash executes whatever the remote endpoint returns without an independent integrity check or review; the PowerShell alternative has the same weakness. Compromise of the installer endpoint or distribution infrastructure could therefore result in arbitrary code execution with the agent's privileges, although the skill contains no evidence that the provider is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI causes the workflow to instruct the agent to execute an internet-delivered installer without explicit approval for local system changes. This crosses the boundary from reading Minerstat data to executing code with the agent's local privileges; the missing-command condition limits exposure but does not authorize installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Minerstat homepage: https://minerstat.com/
- API documentation: https://api.minerstat.com/docs-coins