Security audit
Security checks for vulnerabilities and agentic risk
The CustomGPT workflow is coherent, but its fallback setup runs remote installation code without a separate approval or integrity check.
Review and approve the CLI installation separately before using this skill, including whether it installs other agent skills. Keep the required confirmations for CustomGPT writes and understand that requests pass through OOMOL. Remote installer behavior remains unverified; no malicious behavior was established in the bundled artifact.
The supplied code performs no visible CustomGPT.ai operations. Instead, it downloads and executes an Oomol installation script. Nothing in the supplied content establishes this installation as a supporting dependency for the declared purpose. The remote script's contents are not provided, so its further behavior cannot be assessed.
Piping a mutable HTTPS response directly into bash executes remote code without an intervening integrity or provenance check; the PowerShell alternative uses the same download-and-execute pattern. HTTPS protects transport but does not prevent a compromised vendor endpoint or release pipeline from serving malicious code that runs with the user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup fallback instructs the agent to execute remote installation scripts without requiring user approval for system changes or explaining that the scripts run with the invoking user's privileges. Restricting installation to a missing-CLI error reduces exposure, but a compromised installer could still access local secrets or modify the environment.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources