Security audit
Security checks for vulnerabilities and agentic risk
The Wappalyzer integration is coherent, but its fallback setup runs unverified remote code and does not explain the CLI’s broader changes to agent skills.
Review dependency setup before use. Prefer a separately reviewed, pinned CLI installation and check which agent skills it installs or updates. Installer contents could not be inspected. Requested domains and email addresses pass through OOMOL to Wappalyzer, and lookups may consume account credits.
The supplied command runs an Oomol installer rather than searching or reading Wappalyzer data. The declared description does not disclose this installation behavior, and the supplied code establishes no connection between the installer and Wappalyzer functionality. The downloaded script's further actions cannot be determined from this chunk.
The supplied code consists solely of a login command and shows no connection to Wappalyzer. Authentication could support an implementation, but this chunk provides no evidence of that relationship and does not implement the declared functionality.
The curl-to-bash command executes the current contents of a remote installer without pinning or verifying them. HTTPS protects transport but not against a compromised publisher or hosting system, allowing arbitrary execution and potential access to local files and credentials; this is the same underlying installation issue identified by SQP-2, not an independent exploit.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute remotely retrieved shell or PowerShell code without inspection, integrity verification, or explicit installation approval. A compromised distribution endpoint or altered installer could execute arbitrary code with the agent's permissions; the missing-CLI condition limits exposure but does not make execution safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources