Security audit
Security checks for vulnerabilities and agentic risk
The Bouncer workflow has sensible safeguards, but automatic setup executes unpinned remote code and leaves broader changes to agent skills undisclosed.
Review the CLI installation separately and use a reviewed release. Before running it, consider disabling startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1, as documented in the [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables). Only submit email addresses you are authorized to share with OOMOL and Bouncer. The bundled artifact shows no malicious behavior; the remaining concerns are automatic installation and undisclosed persistent changes, whose exact implementation was not inspected.
The only visible behavior is executing an installer from a different service, rather than interacting with Bouncer. Although dependency installation can be a supporting implementation detail, the supplied chunk provides no evidence that this installer supports Bouncer functionality. The remote script's contents and any further effects are not available for assessment.
The setup command immediately executes remotely fetched shell code without a pinned version or independent integrity verification; the PowerShell alternative has the same weakness. A compromised distribution endpoint or malicious installer update could execute arbitrary commands with the agent's local privileges, exposing files and credentials or modifying the environment. Restricting setup to a missing CLI reduces exposure frequency but does not make the execution safe.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The workflow instructs the agent to submit action payloads through the connector, including email addresses for verification. Although the skill identifies the services involved, it does not warn that user-provided email addresses will be shared with them, and its safety section labels untagged verification actions as safe to run directly.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources