Security audit
Security checks for vulnerabilities and agentic risk
The HelpDesk workflow has clear safeguards, but setup downloads and runs software without a separate installation approval step.
Review and approve CLI installation separately, including any bundled-skill changes. Prefer an inspected, version-pinned installation. Connect only the intended HelpDesk account through OOMOL and retain the documented confirmations for edits and deletions. The downloaded installers and hosted implementation were not verified.
The supplied chunk performs remote script execution for an Oomol installer and contains no HelpDesk operations or evidence connecting that installer to HelpDesk functionality. This is a material capability and resource mismatch, not merely an established supporting implementation detail. The downloaded script's contents and subsequent effects are not available for assessment.
The command pipes a mutable remote script directly into Bash, allowing the fetched content to execute with the invoking user's permissions without prior inspection or independent integrity verification. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from serving malicious code; the missing-CLI condition limits frequency, not execution impact.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs the agent to execute third-party installation code without explicitly obtaining approval for local system changes. Restricting setup to an actual command-not-found error reduces exposure, but a request to manage HelpDesk records does not itself authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- HelpDesk homepage: https://www.helpdesk.com
- API documentation: https://api.helpdesk.com/docs