Security audit
Security checks for vulnerabilities and agentic risk
This StatusPal reader needs review because its setup instructions can execute a remote installer without first asking for approval.
Review and install the CLI yourself before allowing this skill to run. Check its installer and automatic skill-installation behavior, and approve local changes explicitly. Connecting StatusPal entrusts OOMOL with access to that account. The bundled read operations fit the advertised purpose; the concern is uncontrolled setup, not evidence of malicious intent. The external installer and connector implementation were unavailable for verification.
The supplied command contains no StatusPal access or read/search operation. Instead, it executes an external installation script. Nothing in the supplied code establishes this installation as a supporting dependency for StatusPal functionality, so its purpose and resource access materially differ from the declared description.
The command pipes a remotely fetched, unpinned script directly into Bash without integrity verification or review; the PowerShell alternative has the same execution pattern. Compromise of the installer distribution path could execute attacker-controlled code with the invoking user's privileges, exposing local files and credentials; HTTPS and conditional setup reduce some exposure but do not establish script integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software after a missing-command error without explicitly obtaining approval for local system changes. A read-only StatusPal request does not inherently authorize software installation, although the missing-command prerequisite limits when this behavior is triggered.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources