Security audit
Security checks for vulnerabilities and agentic risk
The Dealroom searches fit the stated purpose, but setup tells the agent to execute unverified downloaded code without first seeking your approval.
Review and approve the CLI installation separately, using a verified release where possible. Consider its automatic skill synchronization and connect only the Dealroom account you intend to use. The bundled instructions were fully inspected, but the external installers and hosted connector implementation remain unverified; no malicious behavior was established.
The supplied chunk performs remote script execution rather than a Dealroom data operation. Although installation can be a supporting implementation detail, this chunk provides no evidence that the Oomol installer supports the declared Dealroom functionality. The downloaded script's contents and resulting effects are not shown.
Piping a remotely fetched script directly into bash executes mutable external content without a pinned version, integrity verification, or inspection; the PowerShell example has the same issue. If the installer source or delivery infrastructure is compromised, malicious code could run with the agent process's privileges and access local data or credentials, although the file provides no evidence that the endpoint is currently malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software when the CLI is missing without first explaining that downloaded code will execute locally or requesting approval for system changes. Restricting installation to a missing-CLI error reduces its frequency, but does not authorize modifications to the user's environment.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources