Security audit
Security checks for vulnerabilities and agentic risk
The Chattermill operations have clear approval safeguards, but setup directs the agent to execute unverified remote installation code without a separate approval step.
Review and install the CLI yourself before allowing this skill to run. Check the installer, release integrity, and automatic installation of other agent skills. OOMOL will broker access to your connected Chattermill account; use appropriately limited access and retain the required write/delete confirmations. Remote installer behavior remains unverified.
The supplied command executes an installer hosted on an Oomol domain, with no visible connection to Chattermill. Nothing in the chunk establishes this installation as a supporting dependency for the declared functionality. The downloaded script is not supplied, so its additional behavior cannot be assessed.
The curl-to-bash command executes a mutable remote script without a pinned version or independent integrity verification; the PowerShell alternative follows the same download-and-execute pattern. HTTPS protects transport but does not prevent a compromised distribution endpoint from serving code that can access local files and credentials with the user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation after a missing-command error without requiring approval for executing downloaded code or modifying the local environment. Although this is a legitimate dependency and a conditional path, it expands a Chattermill data request into host-level code execution with the invoking user's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources