Security audit
Security checks for vulnerabilities and agentic risk
The Uploadcare workflow has clear safeguards, but setup directs the agent to execute an unverified remote installer without explicit approval.
Review and approve CLI installation separately, including its bundled-skill synchronization. Prefer a reviewed, version-pinned installation with integrity verification. Remote installer contents remain unverified. Connecting Uploadcare grants OOMOL access through your account; retain the skill's confirmation requirements for storing and deleting files.
The supplied code installs software from Oomol rather than performing Uploadcare operations. Nothing in the chunk establishes this installation as a supporting dependency for Uploadcare. The downloaded script's contents and downstream effects are not provided, so those effects cannot be determined.
Piping an HTTPS response directly into bash executes mutable remote content with the invoking user's permissions, without a pinned version or independent integrity check. Compromise of the installer endpoint or its delivery infrastructure could expose local files and credentials or permit persistent changes; the analogous PowerShell command has the same risk. The legitimate dependency-setup context reduces suspicion of malicious intent but does not remove this supply-chain exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without explaining that this runs third-party code locally or requiring approval for installation. Although setup is conditional, a request to operate Uploadcare could consequently trigger local system changes beyond the requested service operation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources