Security audit
Security checks for vulnerabilities and agentic risk
The Fern reader needs review because its fallback setup executes remote installation code without clearly limiting or reviewing the resulting changes.
Install and review the CLI separately before allowing this skill to run, including any automatic changes to other agents' skills. Use narrowly scoped Fern credentials and understand that OOMOL handles the requested financial data. The complete bundled artifact was inspected, but remote installer behavior remains unverified; no malicious behavior was established.
The supplied command runs an Oomol-hosted installer rather than searching or reading Fern data. Nothing in the supplied chunk establishes this installer as a supporting dependency for Fern access. Remote installer execution is a materially different, undeclared capability. The fetched script's contents and any further effects cannot be determined from this chunk.
The installation command executes a remotely fetched, unpinned script immediately, without an integrity check or opportunity to review it; the PowerShell alternative has the same issue. If the distribution infrastructure is compromised, the script could access local credentials or modify files with the invoking user's privileges, although HTTPS and the conditional setup path reduce some exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to install software without first obtaining approval for local system changes. A request to read Fern data does not inherently authorize software installation, although restricting this fallback to a missing dependency reduces its exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources