Security audit
Security checks for vulnerabilities and agentic risk
The Ayrshare workflow is coherent, but setup can execute unverified downloads and introduce persistent changes to other agent applications without clearly obtaining approval.
Review and explicitly approve the CLI installation before use, preferably using a verified, pinned release. Decide whether to disable its startup skill synchronization and connect only the intended Ayrshare account. Publishing and deletion require confirmation in this skill. The remote installers and server-side connector implementation were not verified; no artifact evidence establishes malicious intent.
The supplied code performs remote script execution for an apparent Oomol CLI installation, not Ayrshare data operations. Nothing in the supplied chunk establishes this installer as a supporting dependency for Ayrshare, making its purpose and resource access materially inconsistent with the description. The downloaded script's further behavior cannot be determined from this chunk.
The supplied code performs only an authentication command and provides no Ayrshare-specific operations or configuration. Authentication could support an Ayrshare integration, but no such relationship is established here; the visible behavior therefore differs materially from the declared purpose.
The command pipes an unpinned remote script directly into Bash without verifying its integrity or reviewing it before execution; the PowerShell alternative has the same trust problem. If the distribution endpoint or release pipeline is compromised, this can execute attacker-controlled code with the invoking user's permissions, potentially exposing local files and credentials; HTTPS and conditional setup do not eliminate that risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs installation through immediate execution of remotely retrieved code without explaining the system changes or obtaining installation-specific approval. Although this is a legitimate dependency setup path and runs only conditionally, the write/destructive confirmation rules concern Ayrshare state and do not clearly cover local software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources