Security audit
Security checks for vulnerabilities and agentic risk
The Beehiiv reading functions fit the stated purpose, but missing-CLI recovery can execute changing remote installers without a clear approval step.
Review and approve CLI installation separately before enabling this skill, including any bundled agent-skill installation. Use a pinned, verified release and an appropriately scoped Beehiiv connection. OOMOL mediates account access and subscriber-data retrieval. The remote installers and hosted runtime were not verified; the artifacts do not establish malicious intent.
The supplied code executes an external installer rather than searching or reading Beehiiv data. Nothing in the chunk establishes that this installer is a supporting dependency for the declared functionality. The remote script's contents are not supplied, so its further behavior cannot be assessed.
The command pipes a mutable remote script directly into bash without pinning a version or verifying its integrity. Compromise of the script's hosting or release pipeline could therefore execute arbitrary code with the local user's permissions; HTTPS protects transport but does not establish that the script itself is safe.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback workflow instructs the agent to execute downloaded shell or PowerShell code without explaining the system changes or requiring installation approval. Although installing the CLI is relevant and conditional, a missing dependency could turn a read-only Beehiiv request into local code execution with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources