Security audit
Security checks for vulnerabilities and agentic risk
The ClickHelp workflow is coherent, but its setup fallback runs downloaded software without verification or a clear user approval step.
Review the setup behavior before installing. Prefer installing a reviewed, verified CLI yourself, and require approval before downloaded setup code runs. Review the CLI's automatic agent-skill installation behavior and grant only the ClickHelp permissions you need. The sole bundled file was inspected; external installer and CLI behavior were not verified against a fixed release.
The supplied chunk performs remote installer execution rather than any visible ClickHelp operation. Although installing a dependency can be a supporting implementation detail, nothing supplied establishes this installer's connection to ClickHelp. The downloaded script's further behavior cannot be determined from this chunk.
Piping a remotely fetched script directly into bash executes mutable external content without a pinned version, integrity check, or opportunity to review it; the PowerShell alternative has the same issue. Although the URL is consistent with the documented CLI provider and installation is conditional, compromise of the distribution endpoint could execute attacker-controlled code with the invoking process's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs installation without requiring approval for executing downloaded code or modifying the local environment. The error-triggered condition limits exposure, but authorization to operate ClickHelp does not necessarily authorize software installation with the agent's local privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources