Security audit
Security checks for vulnerabilities and agentic risk
The SurveyMethods workflow is coherent, but its automatic setup can execute unverified remote software and make broader agent changes without clear user control.
Review and approve CLI installation separately, including its bundled-skill synchronization, before allowing setup. Use a verified release and retain confirmation for SurveyMethods changes. OOMOL mediates access to your account data. The complete bundled artifact was inspected, but the external installers and live connector implementation were not verified; no malicious payload was established.
The supplied command performs remote software installation, not SurveyMethods data operations. Although dependency installation can be a supporting implementation detail, this chunk establishes no connection between the Oomol installer and SurveyMethods. The downloaded script's contents and further effects are not available for assessment.
The command executes mutable remote content directly in Bash without verifying a pinned version, signature, or independently trusted digest; the PowerShell alternative has the same issue. Compromise of the installer distribution could yield arbitrary code execution with the agent's local privileges, although this fallback is conditional and there is no evidence the installer is currently malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs installation of external software without first obtaining approval for local system changes or explaining their scope. This extends authorization for SurveyMethods operations into host modification, although the conditional trigger and declared tool restrictions may limit execution.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources