Security audit
Security checks for vulnerabilities and agentic risk
The Youzan lookup features fit their purpose, but setup can execute downloaded software without first asking for approval.
Review and approve CLI installation separately before allowing setup, including any bundled agent-skill changes. Connect only the intended Youzan shop and consider the sensitive business data accessible through OOMOL. The external installer and live connector implementations were not verified.
The supplied command invokes a remote installer; it contains no visible Youzan search or read functionality. Nothing in the provided material establishes this installer as a supporting dependency for the declared purpose. The downloaded script is not supplied, so its specific effects cannot be determined.
The command pipes a mutable remote script directly into Bash without checking a pinned digest or signature; the PowerShell alternative has the same execution pattern. Compromise of the distribution endpoint or its delivery pipeline could execute attacker-controlled code with the agent's local privileges, potentially exposing files and credentials. HTTPS and the missing-CLI prerequisite reduce some exposure but do not establish artifact integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to execute a remotely supplied installer without first obtaining explicit approval for local software installation. The error-triggered fallback limits exposure, but a read-oriented Youzan request can still lead to local code execution and system changes beyond the user's apparent task.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources