Security audit
Security checks for vulnerabilities and agentic risk
The SurveyMonkey workflow is scoped, but its setup executes unverified remote code and its CLI can silently install additional agent skills.
Review and verify a specific CLI release before allowing setup. Disable startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1 unless you want additional skills installed across your agents. Connect only the intended SurveyMonkey account, consider OOMOL's access to sensitive survey data, and retain the required confirmation before writes. The downloaded installers and exact installed release remain outside the inspected artifact.
The supplied chunk performs remote installer execution rather than SurveyMonkey operations. Although dependency installation can be a supporting implementation detail, this chunk establishes no relationship between the Oomol installer and the declared SurveyMonkey functionality. The downloaded script is not supplied, so its further behavior cannot be determined.
The fallback installation command downloads a mutable remote script and executes it immediately without version pinning, integrity verification, or inspection; the PowerShell alternative uses the same unsafe pattern. Although installation is conditional and the domain belongs to the stated CLI provider, compromise of the distribution endpoint could execute attacker-controlled code with the invoking user's privileges, exposing accessible files and credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- SurveyMonkey homepage: https://www.surveymonkey.com
- API documentation: https://api.surveymonkey.com/v3/docs