Security audit
Security checks for vulnerabilities and agentic risk
The Honeybadger workflow requires confirmation for changes, but its setup fallback can execute an unverified remote installer without clear user approval.
Review and authorize CLI installation separately before enabling this skill. Account for its automatic skill synchronization, and confirm that OOMOL may process your Honeybadger payloads and hold the connected API key. Keep the required write confirmations. The bundled instructions were fully inspected; external installer and connector implementations remain unverified.
The supplied chunk performs remote installer execution, not Honeybadger data operations. Nothing in the provided code establishes that this installation supports the declared purpose. The downloaded script's contents are unavailable, so its further behavior cannot be determined.
The command pipes a mutable remote script directly into Bash without independently verifying its integrity or reviewing it; the PowerShell alternative has the same execution pattern. Compromise of the distribution endpoint or installer could execute arbitrary code with the agent's host privileges, exposing local data and credentials. The legitimate dependency relationship and missing-CLI condition narrow the trigger but do not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software after a missing-command error without first explaining system changes or obtaining explicit approval. Although setup is conditional, permission to perform a Honeybadger operation does not necessarily authorize installing software or executing an external installer on the host.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources