Security audit
Security checks for vulnerabilities and agentic risk
The Pinpoint reading workflow is coherent, but its setup can execute unverified downloads and introduce persistent agent-skill changes without clear user approval.
Review and approve CLI installation separately before use. Check its managed-skill synchronization settings and connect only the intended Pinpoint account. OOMOL handles the integration and sensitive recruiting data. The complete bundled skill was inspected, but external installers and hosted connector behavior remain unverified; no malicious behavior was established.
The supplied chunk performs remote installer execution, not Pinpoint searches or reads. Nothing in the chunk establishes that the Oomol installer is a supporting dependency for the declared purpose. The downloaded script's contents are unavailable, so its further behavior cannot be determined.
Authentication could support a Pinpoint integration, but the entire supplied chunk is a login command with no demonstrated connection to Pinpoint or implementation of the declared functionality. As supplied, its primary behavior does not match the description.
Piping a mutable remote installer directly into bash executes its contents with the invoking user's privileges, without a pinned version or independently verified integrity. A compromised distribution endpoint or altered installer could therefore execute arbitrary local commands; HTTPS protects transport but does not establish that the downloaded script is trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs execution of downloaded shell or PowerShell scripts without explaining their privileges, system changes, or requiring installation approval. This expands a read-oriented Pinpoint task into local code execution; the conditional trigger and declared oo-only Bash allowance reduce immediate exposure but do not make the setup instructions safe if followed.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources