Security audit
Security checks for vulnerabilities and agentic risk
The Colony actions require confirmation for changes, but missing-tool recovery directs the agent to execute remote installers without separate approval or integrity checks.
Review and approve CLI installation separately, using a verified release where possible. OOMOL will mediate access to your connected Colony account, and posts, comments, and votes should retain the stated confirmation requirement. The remote installer and hosted connector implementations are outside this artifact review.
The fallback setup expands a service-data task into local execution of downloaded installer code without explicit user approval or integrity verification. Installing a required CLI is relevant to the skill rather than evidence of concealed malicious behavior, but a compromised installer endpoint could execute arbitrary code with the agent process's local privileges.
Piping an HTTPS response directly into Bash executes whatever the installer endpoint supplies without a review or independent integrity check. HTTPS protects transport but does not prevent a compromised publisher or hosting system from delivering malicious code; the PowerShell setup command presents the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-CLI error, the instructions direct installation through shell or PowerShell execution without explaining the system changes or requiring approval. The conditional setup trigger reduces routine exposure, but the write-confirmation policy covers Colony actions rather than this local code execution.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources