Security audit
Security checks for vulnerabilities and agentic risk
The search features fit the stated purpose, but setup directs the agent to execute unverified remote installers without a separate approval step.
Review the setup before enabling this skill. Install a verified CLI deliberately and require approval before any downloaded installer runs. Review or disable the CLI's automatic skill synchronization. Expect queries to use your OOMOL-connected account; the remote installer and hosted connector were not verified by this package review.
The supplied chunk performs remote software installation rather than searching or reading The Official Board. Although installation can be a supporting implementation detail, the provided material establishes no connection between this installer and the declared functionality. The installer's contents and downstream effects are not available for assessment.
Piping a remotely fetched script directly into Bash executes whatever the endpoint returns with the agent's local privileges, without version pinning or independent integrity verification. Compromise of the installer endpoint or distribution infrastructure could therefore lead to local code execution and access to files or credentials; HTTPS alone does not prevent that supply-chain scenario. The PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct installation after a missing-command error without first explaining that downloaded code will execute locally or obtaining approval for local changes. Although installing a required CLI is legitimate, authorization to read service data does not necessarily authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources