Security audit
Security checks for vulnerabilities and agentic risk
The Snyk reading workflow is coherent, but its fallback setup executes unchecked remote code without separate approval and under-discloses persistent agent changes.
Review and approve CLI installation separately, including its automatic agent-skill synchronization. Use a narrowly scoped Snyk credential and consider whether OOMOL should handle access to your security data. The remote installer payload remains unverified; no malicious behavior was established.
The supplied command performs remote code execution for an apparent Oomol CLI installation, not Snyk searching or reading. Nothing in the supplied chunk establishes this installation as a supporting dependency for Snyk functionality. The downloaded script's contents are not provided, so its further effects cannot be determined.
Piping a live HTTPS response directly into Bash executes remote code without first reviewing it or verifying a pinned artifact; the PowerShell alternative has the same weakness. Compromise of the distribution endpoint or installer could execute attacker-controlled code with the invoking user's privileges, exposing local files and credentials despite the skill's otherwise read-only Snyk operations.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs installation through shell or PowerShell execution without requiring explicit approval or explaining that it runs code locally and may modify the system. Although limited to setup failures, this expands a read-oriented Snyk task into software installation without a clear consent boundary.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources