Security audit
Security checks for vulnerabilities and agentic risk
A routine email request can trigger execution of a downloaded installer without a separate approval or verification step.
Review and approve CLI installation separately, using a verified release. Installer contents were unavailable for inspection. Consider disabling the CLI's automatic skill synchronization using the publisher-documented OO_SKILLS_SYNC_DISABLED setting. Share only intended email data through OOMOL, and retain the required upload and deletion approvals. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md)
The supplied chunk performs remote script execution for an apparently unrelated CLI installer. It contains no EmailListVerify operations or evidence that this installer is a supporting dependency for the declared purpose. The downloaded script is not supplied, so its additional behavior cannot be determined.
Piping a mutable remote installer directly into Bash executes its contents with the invoking user's privileges without a review or integrity-verification step. Compromise of the distribution infrastructure could therefore expose local files and credentials or permit arbitrary system changes; HTTPS alone does not protect against a compromised publisher.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup instructs the agent to execute downloaded shell or PowerShell code without requiring user approval for installation or explaining the resulting system changes. Although this only occurs when the CLI is missing, a routine service request can consequently lead to local code execution outside the requested EmailListVerify operation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources