Security audit
Security checks for vulnerabilities and agentic risk
The Novu integration is coherent, but its setup instructions allow downloaded installation code to run without a separate user approval step.
Review and explicitly approve CLI installation separately. Prefer a verified, fixed release and check whether it installs or updates other agent skills. OOMOL mediates access to your Novu account, so limit its permissions and confirm subscriber changes and notification triggers. The remote installers were not verified; the artifacts provide no evidence of malicious intent.
The supplied command executes a remote installer rather than interacting with Novu. Nothing in the supplied code establishes that installing the Oomol CLI is a supporting requirement for Novu functionality. The remote script's contents are not provided, so its further effects cannot be determined.
The command pipes a mutable remote script directly into Bash without pinning its contents or verifying a trusted signature or checksum; the PowerShell alternative has the same execution pattern. Compromise of the script host or distribution pipeline could therefore execute arbitrary code with the agent's local privileges, despite the legitimate CLI dependency and HTTPS transport.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill instructs the agent to download and execute an installer without first warning the user or obtaining installation approval. This converts a Novu data request into local software installation with the agent's privileges; the missing-command condition limits exposure but does not establish user authorization.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources