Security audit
Security checks for vulnerabilities and agentic risk
The Forem integration is coherent, but its setup fallback directs the agent to execute downloaded installation code without verification or explicit user approval.
Review and approve CLI setup separately before allowing the fallback installer to run. Verify the downloaded code and check its bundled-skill installation behavior. Connecting Forem gives OOMOL access to the account; retain the skill's explicit approval requirement for article creation and updates. External executable contents were not verified in this review.
The supplied code executes an installer from an unrelated domain without any visible connection to Forem. Nothing in the chunk establishes this as a supporting implementation detail for Forem access. The downloaded script's contents and further effects cannot be determined from the supplied code.
Piping a mutable remote script directly into bash executes its contents with the invoking user's privileges without inspecting or independently verifying them; the PowerShell example has the same underlying risk. HTTPS protects transport but not against a compromised distribution server or publisher, which could turn this legitimate dependency setup into arbitrary code execution.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation through downloaded shell or PowerShell code without requiring approval for local software installation or explaining its system effects. Restricting this to a missing-CLI error reduces exposure, but a Forem data request does not inherently authorize executing an installer on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources