Security audit
Security checks for vulnerabilities and agentic risk
The Hotjar workflow has deletion safeguards, but its setup can execute unverified remote code and introduce broader agent changes without clear user approval.
Review the setup before installing. Use a vetted, fixed CLI release, approve local installation changes explicitly, and review or disable its automatic skill synchronization. OOMOL mediates access to your connected Hotjar account; approve the exact target before any deletion. The mutable remote installer remains unverified.
The supplied code performs remote script execution from an unrelated service rather than any demonstrated Hotjar operation. Although installing dependencies can be a supporting implementation detail, this chunk establishes no connection between the Oomol installer and the declared Hotjar functionality. The downloaded script's contents and further effects are not available for assessment.
The curl-to-bash command executes mutable remote content without a pinned version or independent integrity verification; the PowerShell alternative uses the same download-and-execute pattern. Compromise of the installer distribution path could execute arbitrary code with the agent's local permissions, despite HTTPS and the legitimate CLI dependency.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by immediately executing a remote script, without first obtaining approval for local code execution and system changes. Although triggered only when the CLI is missing, this crosses from operating Hotjar into modifying the local environment with the agent's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources