Security audit
Security checks for vulnerabilities and agentic risk
The email-reading functions fit the stated purpose, but automatic setup executes downloaded code without integrity verification or a clear approval step.
Review and authorize CLI installation separately, including its automatic installation and synchronization of agent skills. Prefer a verified installation before using this skill, and connect only the intended Benchmark Email account. OOMOL mediates access to contact data. No malicious payload was established, but the remote installers were unavailable for inspection.
The supplied chunk performs remote script execution rather than any visible Benchmark Email operation. Although installing a CLI could be a supporting implementation detail, nothing supplied establishes that this installer supports the declared service. The downloaded script's contents and any further effects cannot be determined from this chunk.
The curl-to-bash pipeline executes the response from a mutable remote endpoint without inspecting it or verifying an expected artifact. HTTPS protects transport but does not prevent malicious changes at the distribution endpoint, so compromise could expose locally accessible files and credentials; the legitimate CLI dependency and missing-command trigger reduce suspicion, not the execution impact.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs installation by immediately executing downloaded shell or PowerShell content without requiring user approval or integrity verification. Installation is conditional rather than routine, which reduces exposure, but a compromised installer could execute arbitrary code with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources