Security audit
Security checks for vulnerabilities and agentic risk
The RevenueCat reads fit the stated purpose, but fallback setup executes an unverified remote installer without a clear user approval step.
Review and approve CLI setup separately before enabling this skill. Prefer a reviewed, verified CLI release and a RevenueCat key limited to the projects and read permissions you need. OOMOL will mediate access to sensitive customer and revenue data. The current CLI documents OO_SKILLS_SYNC_DISABLED to prevent automatic skill synchronization; confirm this control for your installed version. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md) The remote installers and exact downloaded runtime were not verified.
The supplied command performs remote software installation, not RevenueCat data searching or reading. Nothing in the chunk establishes that this installer is a supporting dependency for RevenueCat access. The downloaded script is not supplied, so its further actions cannot be assessed.
Piping an unpinned remote installer directly into Bash executes whatever the endpoint returns without an independent integrity or authenticity check on the script. Compromise of the distribution infrastructure could therefore allow arbitrary code execution with the invoking user's privileges; HTTPS alone does not protect against a compromised legitimate source.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute remotely downloaded Bash or PowerShell code without first obtaining informed approval for software installation and local system changes. Although conditional setup is legitimate, a read-oriented RevenueCat request does not itself authorize arbitrary installation code running with the agent's local privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources