Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because setup instructs the agent to execute an unverified remote installer without first requesting your approval.
Review and explicitly approve CLI installation and any bundled agent-skill changes before allowing setup. Connecting the service entrusts OOMOL with credentials and connector requests. Keep the required confirmation for template updates. The remote installers and hosted connector implementation were not verified; no artifact-backed malicious behavior was established.
The supplied code performs remote installer execution rather than the declared BlazeMeter data operations. No visible context establishes this installer as a supporting dependency for those operations. The downloaded script's contents and downstream effects cannot be determined from this chunk.
Piping a remotely fetched script directly into bash executes mutable remote content with the agent process's local permissions, without a review or integrity-verification step. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from supplying malicious code; the PowerShell fallback has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without requiring approval for executing remote code or modifying the local environment. Limiting installation to a missing-dependency error reduces exposure, but authorization to perform a BlazeMeter operation does not necessarily authorize local software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources