Security audit
Security checks for vulnerabilities and agentic risk
This Vimeo helper needs review because setup immediately executes remote installers and video transfers bypass its confirmation safeguards.
Review and verify the CLI installer before allowing setup, including whether it installs other agent skills. Confirm OOMOL's access and video-storage retention terms, explicitly authorize video transfers, and retain the existing confirmations for Vimeo changes and deletions. The remote installer and hosted connector were not verified.
The supplied code performs no visible Vimeo operation and instead executes an installer from a different service. Although installing a dependency can be a supporting implementation detail, the supplied chunk establishes no connection between this installer and the declared Vimeo functionality. The remote script's contents and subsequent effects are not available for assessment.
Piping the HTTPS installer directly into bash gives the remotely returned content immediate local code-execution privileges without prior inspection or integrity verification. The endpoint is plausibly legitimate and serves a relevant dependency, but HTTPS alone does not protect against a compromised publisher or distribution service; this is the same underlying issue as SQP-2.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The untagged download_video_file action copies video content into connector transit storage, yet the safety guidance treats all untagged actions as reads safe to run directly. Reading metadata and transferring potentially private media have different confidentiality and retention implications, so this classification can bypass appropriate approval for creating an additional stored copy.
The fallback setup executes remotely supplied shell or PowerShell code without a pinned version or independent integrity verification. If the distribution infrastructure is compromised, the installer can execute arbitrary code with the invoking user's permissions; the missing-CLI condition limits exposure but does not remove this supply-chain risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources