Security audit
Security checks for vulnerabilities and agentic risk
The Indeed workflow has clear approval safeguards, but its missing-tool fallback executes unverified remote installers without a separate approval step.
Review and install the CLI separately before enabling this skill, preferably using a pinned, verified release. Check its persistent changes, including installation or synchronization of other agent skills. OOMOL is a disclosed intermediary for your connected Indeed account. Retain the required confirmations for job-posting changes. The bundled text supports the installation concern, but does not support credential theft or malicious behavior.
The supplied chunk performs remote script execution and contains no Indeed operations. Nothing in the supplied material establishes this installer as a supporting dependency for Indeed functionality. The downloaded script's further behavior cannot be determined from this chunk.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `clear_sourced_job_posting_updates` — Clear updates previously applied to one sourced Indeed job posting. [destructive]
- `find_employer_jobs` — List jobs for the employer represented by the OAuth token, with filters and cursor pagination.
- `get_current_user` — Get the Indeed user and associated employers represented by the OAuth access token.
- `get_job` — Get one Indeed employer job by its EmployerJob IRI.
- `get_jobs` — Get multiple Indeed employer jobs by their EmployerJob IRIs.
- `update_sourced_job_postings` — Update supported fields on one sourced Indeed job posting. [write]
The command pipes a mutable remote script directly into Bash without verifying its integrity or reviewing it before execution. Compromise of the distribution endpoint or release pipeline could therefore lead to arbitrary local code execution; HTTPS alone does not protect against a compromised publisher, and the PowerShell alternative has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs the agent to execute downloaded installation code without an explicit approval step or explanation of local system changes. This expands an Indeed data task into local software installation, and a compromised installer could execute arbitrary code with the invoking user's privileges; the error-triggered condition limits exposure but does not remove the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources