Security audit
Security checks for vulnerabilities and agentic risk
The Pilvio read operations fit the stated purpose, but setup directs the agent to run unverified remote installers without a clear user approval step.
Review setup before enabling this skill. Prefer separately installing a verified CLI release and explicitly approving installation and any additional agent-skill changes. OOMOL will mediate Pilvio account queries. The complete bundled instructions were inspected, but remote installer and release behavior remain unverified.
The supplied code performs remote installer execution rather than searching or reading Pilvio data. No relationship between this installation and the declared Pilvio functionality is established in the chunk, so it cannot be treated as a demonstrated supporting implementation detail. The downloaded script's further behavior is not visible.
Piping a mutable remote installer directly into Bash executes its contents without prior inspection, version pinning, or independent integrity verification; the PowerShell alternative has the same weakness. A compromised distribution endpoint or altered installer could execute arbitrary code with the invoking user's permissions, including accessing local secrets, although no compromise or malicious intent is demonstrated here.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software after a missing-command error without requiring explicit approval for local system changes or explaining that downloaded code will execute. Although this occurs only during setup, a request to read Pilvio data should not implicitly authorize running an installer on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Pilvio homepage: https://pilvio.com/
- API documentation: https://api.pilvio.com/