Security audit
Security checks for vulnerabilities and agentic risk
The GoSquared actions fit the stated purpose, but automatic setup executes unverified downloaded code without clear user approval.
Review setup before enabling this skill. Install a reviewed CLI release separately, require approval for installation, and disable automatic skill synchronization if unwanted. Connect only the GoSquared account and permissions needed. The review concern is uncontrolled setup and its broader effects; the inspected artifact does not establish malicious intent, and the downloaded installers remain unverified.
The supplied command performs remote script execution and appears intended to install a CLI. It contains no GoSquared search or read operation and establishes no connection between the installer and the declared GoSquared functionality. The downloaded script's contents are not supplied, so its further effects cannot be assessed.
Piping a remotely fetched installer directly into Bash executes mutable network content without prior inspection or artifact verification. HTTPS protects transport but does not prevent a compromised distribution server or malicious installer update from executing code with the agent's privileges; the PowerShell setup has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup instructs the agent to execute downloaded shell or PowerShell scripts without an explicit approval gate, integrity verification, or explanation of local system effects. Although limited to a missing-CLI condition, this can turn a read-only analytics request into local code execution with the agent's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources