Security audit
Security checks for vulnerabilities and agentic risk
The Screendesk workflow is coherent, but its automatic remote installation step and under-disclosed changes to agent skills warrant review.
Review and install the CLI yourself before allowing this skill to run. Check whether its automatic skill synchronization is acceptable; the documentation provides OO_SKILLS_SYNC_DISABLED to disable it. OOMOL mediates access to your connected Screendesk account, so grant only the permissions needed and confirm recording updates. The remote installer contents and exact release behavior remain unverified.
The supplied chunk performs remote software installation rather than the declared Screendesk data operations. Although installation can be a supporting implementation detail, nothing supplied connects this Oomol installer to Screendesk. The downloaded script's contents and subsequent effects cannot be determined from this chunk.
The command streams a mutable remote script directly into Bash without verifying its integrity or reviewing it; the PowerShell alternative uses the same fetch-and-execute pattern. Compromise of the distribution endpoint or release process could execute arbitrary code with the invoking user's permissions, although the legitimate dependency and HTTPS URL provide no evidence of malicious intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-command error, the skill instructs the agent to install software without first obtaining approval or explaining that downloaded code will execute and may modify the local environment. Restricting installation to first-time setup reduces exposure, but authorization to access Screendesk does not necessarily authorize local software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources