Security audit
Security checks for vulnerabilities and agentic risk
The Buildium reading workflow fits its purpose, but setup can execute a downloaded installer without verification or a clear approval step.
Review the setup before enabling this skill. Install and verify the CLI separately, check whether it adds skills to other agents, and connect only the Buildium account and permissions you intend OOMOL to access. The remote installer and hosted connector implementation were not verified; no malicious behavior was established.
The supplied code performs remote script execution and contains no visible Buildium integration or data-reading functionality. Nothing supplied establishes this installer as a supporting dependency for the declared purpose. The downloaded script's contents and downstream effects cannot be determined from this chunk.
Piping a remotely fetched installer directly into Bash executes mutable network-delivered code without independent integrity verification; the PowerShell example uses the same pattern. A compromised distribution endpoint could execute arbitrary commands with the agent's local privileges, potentially exposing files or credentials, although the supplied content provides no evidence that the endpoint is currently malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs the agent to execute an installer without requiring explicit approval for local system changes or explaining that downloaded code will run with the invoking user's privileges. Conditional execution limits exposure, but a read-oriented Buildium request does not itself authorize installing software; this finding overlaps with SC2.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources