Security audit
Security checks for vulnerabilities and agentic risk
The Gamma workflow is coherent, but its setup directs execution of an unverified remote installer without a clear approval step.
Review the CLI installation separately before allowing setup. Prefer a pinned, verified release, and review or disable its automatic bundled-skill synchronization before first use. Gamma requests pass through OOMOL; connect only the intended account and confirm generation payloads. The remote installer contents could not be inspected, so their exact local changes remain uncertain.
The supplied chunk performs remote installer execution rather than accessing Gamma data. Installing a dependency can be a supporting implementation detail, but this chunk provides no evidence connecting the Oomol installer to the declared Gamma functionality. The downloaded script's contents and subsequent behavior are not available for assessment.
Piping a mutable remote installer directly into bash executes its contents with the invoking user's privileges without review or independent integrity verification. Compromise of the distribution endpoint could therefore expose local files and credentials or enable persistence; the missing-CLI condition limits when this occurs, and HTTPS alone does not protect against a compromised publisher.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs execution of remote shell and PowerShell scripts without explaining that they run local code or requiring explicit installation approval. Although installing a prerequisite is legitimate, it expands a Gamma operation into potentially consequential system changes; the declared oo-only tool allowance may limit execution but does not make these instructions safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources