Security audit
Security checks for vulnerabilities and agentic risk
The StoreCensus reading workflow is coherent, but its setup instructions execute remote installers without a clear approval or verification step.
Prefer an existing, reviewed oo installation. Require separate approval before setup, verify the downloaded software, and review any automatic bundled-skill changes. StoreCensus requests use your OOMOL-connected account. The remote installer contents and their exact local effects remain unverified; no malicious behavior was established.
The supplied code performs remote script installation rather than searching or reading StoreCensus data. Nothing in the chunk establishes the installer as a supporting dependency for StoreCensus functionality. The installer's downstream actions cannot be determined from the supplied code.
Piping a remote script directly into bash executes mutable network-supplied code with the invoking user's privileges, without a review or integrity-verification step; the PowerShell example has the same weakness. Compromise of the distribution endpoint could therefore lead to local data theft or arbitrary system changes, although installation is only a fallback and no compromise is demonstrated here.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software without first explaining local changes or obtaining explicit approval. A request to read StoreCensus data does not necessarily authorize installing software, although the missing-CLI condition limits when this workflow is reached.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources