Security audit
Security checks for vulnerabilities and agentic risk
The DealNews features fit their purpose, but automatic setup executes unchecked downloaded code and leaves broader changes to your agent environment unexplained.
Review setup before installing. Prefer a verified, pinned CLI installation and explicitly control changes to other agent skills. Upstream documents OO_SKILLS_SYNC_DISABLED=1 to disable startup skill synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Consider OOMOL authentication and usage charges. The remote installers and hosted implementation were not inspectable; the reviewed artifact does not establish malicious intent or exfiltration.
The supplied command executes an external installation script, with no visible connection to DealNews functionality. This introduces remote code execution and installation behavior not described by the declared purpose. The downloaded script's contents and ultimate effects are not available for inspection.
The supplied code only invokes a login command. It contains no DealNews search or read operation and establishes no connection between this authentication step and DealNews. On the supplied evidence, authentication is the sole behavior rather than a demonstrated supporting implementation detail.
The setup instructions pipe a remotely fetched, unpinned script directly into Bash, and the PowerShell alternative likewise immediately executes downloaded content. If the distribution endpoint or delivery pipeline is compromised, attacker-controlled code runs with the invoking user's privileges, potentially exposing local secrets or modifying files. Restricting this to missing-CLI setup reduces exposure frequency but does not provide integrity verification or explicit approval for host changes.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources