Security audit
Security checks for vulnerabilities and agentic risk
The Pexels features fit the stated purpose, but setup can run unverified downloaded software without clear user approval.
Review setup before installing. Install a reviewed, version-pinned CLI separately, decide whether to allow its automatic skill synchronization, and connect only the intended Pexels account through OOMOL. The external installer could not be inspected and was not executed. The evidence supports setup concerns, not a claim of malicious intent.
The supplied code performs remote script execution, with no visible Pexels search or data-reading behavior. Nothing provided establishes this installer as a supporting dependency for the declared purpose. The downloaded script's contents and any additional effects cannot be determined from this chunk.
The command pipes a mutable network response directly into Bash without version pinning, independent integrity verification, or review. Compromise of the installer distribution path could execute arbitrary code with the agent's local permissions; HTTPS and the legitimate dependency context do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by executing downloaded shell or PowerShell code without first explaining the system changes or obtaining installation approval. Although conditional on a missing CLI, this expands a read-only Pexels request into local code execution with the agent process's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources