Security audit
Security checks for vulnerabilities and agentic risk
The Bitrise actions have clear safeguards, but setup can execute unverified remote installers without separate user approval.
Review setup before enabling this skill. Install a verified CLI version yourself and review or disable its automatic skill synchronization. Connecting Bitrise authorizes OOMOL to mediate account operations, and triggering builds may consume resources. Keep the skill's write-confirmation requirement. The bundled instructions were fully inspected, but downloaded installer behavior remains unverified.
The visible code performs an Oomol installation rather than the declared Bitrise data operations. No evidence in the supplied chunk establishes this installation as a supporting dependency for Bitrise. The downloaded script's additional behavior cannot be determined from this command alone.
Piping an HTTPS response directly into bash executes mutable remote content without pinning, integrity verification, or review. A compromised distribution endpoint could therefore run arbitrary commands with the agent process's access, potentially exposing local credentials and modifying files; the legitimate CLI setup context does not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct execution of downloaded shell and PowerShell scripts without an explicit approval gate or explanation of host changes. Although installation is a legitimate prerequisite and only occurs when the CLI is missing, it crosses from Bitrise operations into arbitrary code execution with the agent process's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources