Security audit
Security checks for vulnerabilities and agentic risk
The Runscope read operations are appropriately scoped, but automatic software setup needs review because it executes unverified remote code and can introduce persistent agent changes.
Review and approve the CLI installation separately, using a verified release. Understand that OOMOL handles the Runscope connection and credentials. Review the CLI's persistent skill synchronization; its documentation provides OO_SKILLS_SYNC_DISABLED to disable startup synchronization. The full bundled artifact was inspected, but the remote installer and hosted connector implementation remain unverified. No malicious behavior was established.
The supplied command executes an external installation script from cli.oomol.com. Nothing in the chunk connects this installer to Runscope or implements Runscope data access. Executing an unrelated remote installer is a materially different capability from the declared search-and-read purpose. The downloaded script's specific actions cannot be determined from this chunk.
The command pipes a remotely fetched, mutable script directly into Bash without verifying its integrity or reviewing its contents; the PowerShell alternative has the same execution pattern. A compromised distribution endpoint or installer could execute arbitrary code with the agent process's permissions, potentially accessing local secrets or modifying files. HTTPS and the legitimate dependency context reduce suspicion of malicious intent but do not establish installer integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to install software without requiring approval or explaining the resulting local system changes. A request to read Runscope data does not inherently authorize installing executable software, although limiting installation to a missing-command error reduces unnecessary exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Runscope homepage: https://www.blazemeter.com/api-monitoring
- API documentation: https://api.runscope.com/docs