Security audit
Security checks for vulnerabilities and agentic risk
The Cursor integration is clearly described, but its setup runs changeable remote software without clear approval or disclosure of broader agent changes.
Review and approve CLI installation separately. Check which agent skill files it installs or updates, and disable automatic skill synchronization if unwanted. OOMOL will mediate Cursor account access. Keep the skill's confirmation requirements for cloud-agent creation, other writes, and deletion. The remote installers' full effects remain unverified.
The supplied code performs remote installer execution, not Cursor data operations. Nothing in the supplied chunk establishes that installing the Oomol CLI is a supporting requirement for Cursor access. The downloaded script's contents and any further actions are not available for assessment.
The command immediately executes a remotely fetched script without a pinned version or independent integrity verification; the PowerShell alternative has the same weakness. If the distribution endpoint or release pipeline is compromised, attacker-controlled code could execute with the agent process's local permissions and access available files or credentials. HTTPS and the missing-CLI condition reduce some exposure but do not protect against a compromised publisher.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-command fallback directs the agent to install software without explicitly obtaining approval for local system changes or explaining the installer's scope. The conditional trigger limits exposure, but the confirmation rules cover Cursor state changes rather than local installation, leaving a consent gap.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources