Security audit
Security checks for vulnerabilities and agentic risk
The skill’s web-fetching function is coherent, but automatic installer execution and undisclosed changes to other agents’ skills warrant review.
Review and explicitly approve CLI installation before use, using a verified release rather than automatically executing a downloaded installer. Review or disable its documented startup skill synchronization before the first command. OOMOL mediates requests and credentials, so consider what URLs and headers you submit. The external installers remain unverified; the reviewed artifact does not establish malicious behavior.
The supplied command performs remote script execution, not Zenscrape searching or data reading. No connection is established between the Oomol installer and the declared functionality, so this is not a demonstrated supporting implementation detail. The downloaded script's contents and subsequent effects are not available for assessment.
The supplied chunk performs only a login operation, not Zenscrape searching or data retrieval. Authentication could be a supporting implementation detail if tied to Zenscrape, but the supplied content establishes no such relationship. As shown, its behavior does not match the declared purpose.
The curl-to-bash pipeline executes the current contents of a remote endpoint without pinning, signature verification, or an opportunity to inspect the complete script first. HTTPS protects transport but does not protect against a compromised distribution server or malicious installer update, either of which could lead to arbitrary code execution under the agent's account. This is the same installation risk underlying the SQP-2 finding, not a separate exploit chain.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the fallback directs the agent to execute a remotely downloaded installer without an explicit user-approval or integrity-verification step. This crosses from reading Zenscrape data into executing code and modifying the local environment; a compromised installer could run with the agent's operating-system privileges. The conditional trigger limits exposure but does not remove the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources