Security audit
Security checks for vulnerabilities and agentic risk
The skill requires confirmation for Daily changes, but its fallback setup can execute remote installation code without asking you first.
Review setup before installing. Install the CLI yourself from a verified release and require approval before any installer runs. Check whether it adds or updates other agent skills, and connect only the intended Daily account. Daily writes and deletions already require confirmation; the material concern is uncontrolled dependency setup, not evidence of malicious intent.
The supplied code installs software from cli.oomol.com rather than interacting with Daily. Nothing in the chunk establishes this installer as a supporting dependency for Daily functionality. Remote script execution is not disclosed by the description, and the downloaded script's further behavior cannot be determined from this chunk.
The command streams a mutable remote script directly into Bash without independent integrity verification or review; the PowerShell alternative uses the same execution pattern. Although the URL belongs to the declared integration provider and setup is conditional, compromise of the distribution endpoint could execute arbitrary code with the invoking user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without explicitly obtaining approval for local system changes. The missing-command prerequisite limits when this occurs, but the write-confirmation safeguards cover Daily state changes rather than local installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources