Security audit
Security checks for vulnerabilities and agentic risk
The Fellow workflow has clear approval rules, but its setup fallback runs changeable remote installers without a separate approval step.
Review and approve CLI installation separately before enabling the fallback, including any automatic installation of other agent skills. Prefer a verified, pinned release. Fellow data passes through OOMOL, so connect only the intended account and permissions. Keep the existing confirmation requirements for changes and archives. The remote installer contents remain unverified; this review found no artifact-backed evidence of malicious intent.
The supplied code performs remote installer execution rather than any demonstrated Fellow operation. Although installation can be a supporting implementation detail, nothing in this chunk establishes that the Oomol installer supports the declared Fellow integration. The remote script's contents and additional effects cannot be determined from the supplied code.
The command streams a remotely fetched script directly into Bash without a pinned version or independent integrity verification; the PowerShell alternative has the same execution pattern. Compromise of the distribution endpoint or delivery pipeline could execute attacker-controlled code with the invoking user's privileges, exposing local files and credentials. Its legitimate prerequisite role and conditional execution reduce exposure but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software after a missing-command error without requiring approval for local system changes. Authorization to operate Fellow does not necessarily authorize installing software, and the skill's confirmation rules cover Fellow state changes rather than installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources