Security audit
Security checks for vulnerabilities and agentic risk
Setup needs review because it directs remote code execution and can introduce ongoing changes to other agent skills without clearly explaining or obtaining approval for those effects.
Review and approve CLI installation separately, including any changes to other agents' skills. The installer contents could not be inspected. The linked [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md) documents OO_SKILLS_SYNC_DISABLED to suppress startup skill synchronization. Browse AI access through OOMOL is disclosed, and the skill requires approval before writes or cookie replacement.
The code accesses an Oomol installation endpoint and executes its response, which is materially different from the declared Browse AI purpose. Nothing supplied establishes this installer as a supporting dependency for Browse AI. The remote script's contents are unavailable, so its further behavior cannot be determined.
Piping a remotely fetched script directly into Bash executes its contents with the invoking user's privileges without a separate review or integrity-verification step. HTTPS protects transport but does not prevent a compromised distribution endpoint from supplying malicious code; the PowerShell setup example has the same risk. The legitimate dependency relationship and conditional execution reduce exposure but do not eliminate this supply-chain vulnerability.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software when the CLI is missing without requiring explicit approval or explaining the installer's local effects. A request to operate Browse AI does not necessarily authorize installing executable software or changing the local environment, although the conditional setup limits exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources