Security audit
Security checks for vulnerabilities and agentic risk
A routine Hamsa lookup can lead to unverified software installation and broader agent changes without a clear approval step.
Review the setup before enabling this skill. Install a reviewed, pinned CLI release yourself, require approval for installation commands, and review or disable automatic skill synchronization. OOMOL mediates access to your connected Hamsa account. The remote installers and hosted implementation were not verified; no artifact evidence establishes malicious intent.
The declared purpose is Hamsa data access, but the supplied command executes an Oomol installer without showing any connection to that purpose. This introduces remote code execution against an inconsistent resource, rather than a demonstrated supporting implementation detail. The downloaded script's further behavior cannot be determined from this chunk.
Piping an HTTPS download directly into Bash executes mutable remote content without independent integrity verification or an opportunity to inspect it first; the PowerShell example has the same property. If the installer source or delivery infrastructure is compromised, attacker-controlled code could run with the invoking user's permissions, potentially accessing local secrets and modifying files.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs installation through remotely executed scripts without requiring informed user approval for local software installation. The conditional setup context reduces exposure, but a routine read request could still lead an agent to make unexpected system changes; the declared tool restriction may constrain execution but is not an explicit consent safeguard.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources