Security audit
Security checks for vulnerabilities and agentic risk
The Affinity functions fit their purpose, but setup can execute unverified downloaded code and make broader agent changes without a clear approval step.
Review and approve a verified, version-pinned CLI installation separately, including any changes to other agents' installed skills. Understand that OOMOL brokers access to your connected Affinity account. The complete bundled artifact was inspected, but remote installer contents and live service behavior remain unverified; no malicious intent was established.
The supplied chunk performs remote script execution rather than searching or reading Affinity data. Dependency installation can be a supporting implementation detail, but nothing supplied establishes that this installer supports the declared Affinity functionality. The downloaded script's contents and further effects are not available for assessment.
The command streams a mutable remote script directly into bash without verifying a signature, checksum, or pinned version. HTTPS protects transport but does not prevent a compromised distribution endpoint from supplying code that can access local files and credentials with the executing user's permissions; conditional execution reduces exposure but does not remove this risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute remote installation scripts without explaining local system changes or obtaining explicit installation approval. Although setup is relevant and conditional, a missing dependency can turn a read-only Affinity request into arbitrary code execution with the agent's local permissions; this overlaps with the SC2 finding.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources