Security audit
Security checks for vulnerabilities and agentic risk
The search functions fit their purpose, but setup executes unpinned remote code and can introduce additional persistent agent skills without clearly disclosing that scope.
Review and approve a specific CLI release separately before allowing automatic setup. Consider disabling startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1 before invoking oo, as described in the linked documentation. Expect OOMOL account authorization and possible service charges. The remote installers and CLI binary were not audited; the concern is installation scope and user control, with no artifact-backed evidence of intentional malicious behavior.
The supplied command performs remote script execution rather than searching or reading Magnific data. Nothing in the supplied chunk establishes that this installer is a supporting dependency for the declared functionality. The downloaded script's specific actions cannot be determined from this chunk.
The setup instructions pipe a remotely fetched, unpinned script directly into Bash without integrity verification or an explicit approval step; the PowerShell alternative uses the same download-and-execute pattern. If the installer source or distribution pipeline is compromised, attacker-controlled code could run with the agent's local permissions and access files or credentials. The missing-CLI condition limits exposure but does not make installation necessary or safe for an otherwise read-oriented task.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources