Security audit
Security checks for vulnerabilities and agentic risk
The Flexmail actions have clear approval controls, but setup can execute an unchecked installer and introduce changes to other agent skills.
Review and install the CLI separately before enabling this skill, and decide whether to allow its bundled-skill synchronization. OOMOL will mediate access to your Flexmail account. Keep the required approvals for changes and deletions. The remote installer could not be inspected, so its exact installation effects remain uncertain.
The supplied code performs remote installer execution rather than the declared Flexmail data-management operations. Nothing in the chunk establishes this installation as a supporting requirement for Flexmail. The remote script's contents and any additional effects cannot be determined from the supplied code.
The command pipes a mutable remote script directly into Bash without pinning or verifying its contents; the PowerShell example has the same execution pattern. Compromise of the installer distribution path could execute attacker-controlled code with the agent's local permissions, exposing accessible files and credentials, although installation is only triggered when the CLI is missing.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to execute remotely downloaded shell or PowerShell code without an explicit installation approval or integrity-verification step. A missing dependency is a legitimate setup condition, but it does not authorize arbitrary installer changes to the host; this overlaps with the SC2 finding rather than representing an independent exploit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Flexmail homepage: https://flexmail.be/en
- API documentation: https://api.flexmail.eu/documentation/