Security audit
Security checks for vulnerabilities and agentic risk
This Foxit integration needs review because it treats document-changing operations as reads and can execute an unverified remote installer.
Review before installing. Correct the read/write classifications and require clear authorization for processing jobs, document changes, uploads, and quota use. Install a verified CLI release under your control and review its automatic skill synchronization. Documents pass through Foxit and OOMOL-related services; their runtime handling and retention were not verified. No evidence establishes malicious intent.
The supplied chunk performs remote installer execution, not Foxit Cloud API operations. Nothing in the supplied content establishes that this installer is a necessary supporting dependency for Foxit access. The installer's downstream behavior is unknown, but downloading and executing it is directly observable and materially outside the declared purpose.
The setup command executes a remotely fetched, mutable script without checking a pinned version, checksum, or signature; the PowerShell alternative has the same weakness. Compromise of the distribution endpoint or release pipeline could execute attacker-controlled code with the agent's local privileges, although the missing-CLI prerequisite limits when this path is reached.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The blanket claim that untagged actions are reads contradicts descriptions of actions that submit processing tasks, create documents, or upload results to transit storage. Treating those actions as safe to run directly bypasses the skill's confirmation policy and can cause unapproved processing, storage, or quota consumption, although the text does not establish that these operations overwrite source documents.
This finding identifies the same confirmation-policy defect as SDI-4: document-processing actions are untagged and therefore incorrectly authorized as reads. That classification can bypass approval for consequential operations, but action names alone do not prove destructive modification of existing files.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources