Security audit
Security checks for vulnerabilities and agentic risk
The Gleap workflow requires approval for data changes, but its setup instructions can execute unverified downloaded software without separate approval.
Review setup before enabling this skill. Prefer installing a verified CLI release yourself and prevent automatic execution of the download-to-shell commands. Gleap requests pass through OOMOL, so connect only the account and permissions needed. Retain the explicit approvals for updates and deletions. The remote installers and hosted connector were not audited.
The supplied command installs or runs software from cli.oomol.com rather than managing Gleap data. Nothing in the chunk establishes this installer as a supporting dependency for Gleap, so its remote-code execution behavior is not represented by the declared purpose. The downloaded script's further actions cannot be determined from this chunk.
Piping an HTTPS response directly into Bash executes the remote server's current content with the agent process's local privileges, without verifying a fixed artifact. A compromised distribution endpoint or malicious installer update could access local data or alter the environment; the legitimate installation purpose and missing-CLI condition reduce exposure but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to execute downloaded shell or PowerShell scripts without a separate approval checkpoint or integrity verification. Although setup is limited to a missing CLI, a routine Gleap request could consequently trigger local software installation and execution of remotely controlled code.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources