Security audit
Security checks for vulnerabilities and agentic risk
The research functions fit the description, but setup directs the agent to execute unverified downloaded code without clear user approval.
Review and approve CLI setup separately before allowing installation. Prefer an inspected, version-pinned release and review its automatic skill synchronization. Research queries use your OOMOL-connected account and may consume credits. The installer payloads were unavailable for inspection; no malicious behavior was established.
The supplied command performs remote script execution rather than searching or reading Web of Science data. Nothing in the supplied chunk establishes that this installer is a supporting dependency for the declared purpose. The downloaded script's contents and further effects are not available for assessment.
Piping a remotely fetched script directly into bash executes mutable network-delivered code with the agent process's local permissions, without a pinned version or independent integrity verification; the PowerShell example has the same weakness. Compromise of the distribution endpoint or release process could enable local data theft or modification, despite HTTPS and the legitimate dependency-setup context.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is absent, the instructions direct the agent to install software without first obtaining approval for local changes and remote-code execution. A request to search bibliographic records does not itself authorize software installation; the missing-command condition limits exposure but does not establish consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources