Security audit
Security checks for vulnerabilities and agentic risk
The Panjiva workflow has sensible approval rules, but its setup can run unverified installation code and introduce persistent agent skills without explaining those effects.
Review the CLI installation separately and disable unwanted startup skill synchronization before using it. Panjiva requests pass through OOMOL, so connect only the intended account and review write payloads. The scanner's two missing-reference gaps are a version string and a JSON response example, not missing executable files. The package contains only the inspected Markdown; remote installer contents and hosted connector behavior remain unverified. No malicious behavior was established.
The supplied chunk only runs an Oomol CLI installer; it contains no Panjiva integration or data operations. Dependency installation can be a supporting implementation detail, but this chunk does not establish that relationship. The remote installer's contents and any additional effects cannot be determined from the supplied code.
Piping a remotely fetched script directly into Bash executes its current contents without a pinned version or independent integrity verification. If the distribution endpoint or its publishing pipeline is compromised, that code could access files and credentials or modify the environment with the invoking user's privileges; HTTPS alone does not prevent this supply-chain scenario.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation through downloaded shell or PowerShell code without explaining its potential local effects or requiring explicit approval. Restricting this behavior to a missing-CLI error reduces exposure, but a normal prerequisite failure can still lead to executing code outside the requested Panjiva operation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources