Security audit
Security checks for vulnerabilities and agentic risk
The article workflow is well scoped, but setup directs the agent to run an unchecked remote installer without separate approval.
Review and explicitly approve a verified CLI installation before allowing setup. Review or disable its automatic bundled-skill synchronization, and consider OOMOL's access to article requests and connected accounts. Article creation already requires your approval. The downloaded installers and external connector implementation were not verified.
The supplied command executes an external installer associated with Oomol, with no visible connection to Autoblogging.ai or its data operations. The supplied chunk does not establish this installation as a supporting dependency of the declared service. The downloaded script's additional behavior cannot be determined from the command alone.
Piping the downloaded installer directly into bash executes mutable remote content without checking a pinned version, signature, or trusted digest. HTTPS protects transport but does not prevent a compromised installer host or release pipeline from delivering code that accesses local files, credentials, or other resources available to the process.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-command error, the skill directs installation through remotely downloaded shell or PowerShell code without explicitly obtaining approval for local system changes. This expands an Autoblogging.ai task into arbitrary code execution with the agent's privileges; the conditional setup trigger reduces exposure but does not authorize that expansion.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources