Security audit
Security checks for vulnerabilities and agentic risk
The Speedtest Tracker functions are coherent, but missing software triggers a downloaded installer without a separate approval step.
Review and install the CLI yourself before use, and decide whether to allow its automatic agent-skill synchronization. Connect only the Speedtest Tracker permissions you need and understand that requests pass through OOMOL. The remote installers and hosted connector were not fully verified; no malicious behavior was established.
The supplied command performs remote installer execution, not Speedtest Tracker data operations. Nothing in the provided description or code establishes that installing the Oomol CLI is a supporting requirement for the declared purpose. The downloaded script is not supplied, so its additional behavior cannot be assessed.
The supplied code only performs an authentication action; it contains no Speedtest Tracker operations or configuration tying the login to that service. Authentication could be a supporting implementation detail if such a connection were established, but the supplied chunk does not establish one.
Piping an HTTPS response directly into Bash executes mutable remote code with the invoking user's permissions, without an independent integrity check or review. A compromised installation endpoint or release pipeline could compromise local files and credentials; the conditional setup path limits exposure but does not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without first explaining the system changes or obtaining installation-specific approval. Although installation is a legitimate dependency and only occurs when the CLI is missing, a request to operate Speedtest Tracker does not necessarily authorize installing executable software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources