Security audit
Security checks for vulnerabilities and agentic risk
The Shotstack workflow is coherent, but its setup instructions can trigger execution of an unverified remote installer without separate approval.
Review and install the required CLI yourself before use, including its automatic skill-installation behavior. Require explicit approval for any installer execution. OOMOL mediates your Shotstack connection and submitted data; verify its account permissions and review each render payload and expected charges. The concern is insufficient control over setup, with no artifact-backed evidence of malicious intent.
The declared purpose concerns Shotstack operations, but the supplied code executes an Oomol-hosted installation script. Nothing in the chunk establishes this as a supporting dependency for Shotstack. The installer’s contents and any subsequent behavior are not provided.
The command pipes a remotely fetched, unpinned script directly into Bash without inspecting or independently verifying its contents; the PowerShell setup uses the equivalent download-and-execute pattern. A compromised installer endpoint or release pipeline could execute arbitrary code with the invoking user's permissions, including accessing local files and credentials; HTTPS alone does not establish that the script is trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-CLI error, the skill directs installation without requiring explicit user approval or explaining that downloaded code will execute locally and may modify the environment. The error-triggered setup condition limits exposure, but confirmation requirements for Shotstack writes do not protect this separate local execution path.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources