Security audit
Security checks for vulnerabilities and agentic risk
The ActiveCampaign workflow is coherent, but its setup instructions can automatically execute downloaded software without a separate approval or integrity check.
Review the automatic installation fallback before enabling this skill. Install the CLI yourself from a reviewed, verified release and require approval for future software installation. OOMOL mediates access to your ActiveCampaign account; use an appropriately scoped connection and retain the required confirmation for contact changes. The remote installers and service implementation were not inspected.
The supplied chunk performs remote installer execution and contains no ActiveCampaign data operations or demonstrated connection between the installer and ActiveCampaign functionality. Although dependency installation can be a supporting implementation detail, that relationship is not established here. The downloaded script's contents and further effects are not visible in the supplied code.
Piping a mutable remote installer directly into bash executes its contents with the agent's local privileges without prior inspection or independent integrity verification. Compromise of the distribution endpoint or its supply chain could enable local data theft or modification; HTTPS does not protect against a compromised publisher. The Windows download-and-execute example presents the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute a downloaded installer without requiring user approval for local software installation or explaining its system effects. Although triggered only when the CLI is missing, this expands a CRM task into local code execution; the confirmation requirements for ActiveCampaign writes do not cover this operation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources