Security audit
Security checks for vulnerabilities and agentic risk
The Podscribe functions fit the stated purpose, but setup can execute unverified downloaded code without a clear user approval step.
Review and approve CLI setup separately before allowing this skill to install software. Prefer a verified, pinned release, and check or disable automatic installation of other agent skills. OOMOL will handle the connected Podscribe account. The review concern is uncontrolled setup and insufficiently disclosed persistent changes; the inspected artifact does not establish malicious intent.
The supplied code performs remote installer execution rather than Podscribe data access. Installing a dependency could be a supporting implementation detail, but the supplied content establishes no connection between this installer and the declared Podscribe functionality. The downloaded script's contents and effects are not available for assessment.
The command pipes mutable remote content directly into a shell without verifying a pinned release, checksum, or signature; the PowerShell alternative has the same weakness. Compromise of the installation endpoint or distribution pipeline could execute arbitrary code with the agent process's privileges and access local data or credentials. HTTPS and the legitimate dependency context reduce suspicion of malicious intent but do not establish script integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A request to read Podscribe data can trigger instructions to install local software without first explaining the system changes or obtaining approval. Restricting this fallback to a missing CLI reduces its frequency, but does not make installation an authorized consequence of a read-only data request.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources