Security audit
Security checks for vulnerabilities and agentic risk
Precoro access is appropriately limited to reading, but automatic CLI setup can execute unverified software and introduce undisclosed changes to other agents.
Review and explicitly approve CLI setup before use, preferably installing a verified version yourself. Understand that Precoro access runs through OOMOL. Review or disable automatic skill synchronization using the publisher's [documented controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). The downloaded installers were unavailable for inspection, so their exact system changes remain uncertain.
The supplied command performs remote script execution rather than searching or reading Precoro data. Nothing in the chunk establishes that the Oomol CLI installer is a supporting dependency for Precoro access. The downloaded script's contents and any further effects are not available for assessment.
The curl-to-bash command immediately executes a mutable remote script without a pinned version or independent integrity verification. If the distribution endpoint or release pipeline is compromised, attacker-controlled code could run with the invoking user's permissions, exposing accessible files and credentials; HTTPS alone does not protect against a compromised publisher.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to execute a downloaded shell or PowerShell installer without first obtaining explicit approval for local software installation. Although limited to first-time setup, this expands a read-only Precoro request into local code execution and possible persistent system changes.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources