Security audit
Security checks for vulnerabilities and agentic risk
The Instatus features have clear safeguards, but setup executes unverified remote installers and leaves broader agent-skill changes undisclosed.
Review and approve CLI installation separately, and use a verified, fixed release. Consider whether you trust OOMOL with the connected Instatus account and operation data. The publisher documents OO_SKILLS_SYNC_DISABLED=1 to prevent startup skill synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables). Installer contents and exact release behavior remain unverified; no artifact-backed malicious intent was established.
The supplied chunk installs Oomol CLI software and contains no Instatus operations or evidence connecting that installation to the declared purpose. Remote installer execution is not disclosed by the description. The downloaded script's contents and further effects cannot be determined from this chunk.
Piping an HTTPS response directly into Bash executes mutable remote content with the invoking user's permissions, without verifying a pinned version, signature, or independently trusted digest. Compromise of the installation endpoint or its release infrastructure could therefore expose local files and credentials or enable persistence; the PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to execute remotely supplied installation code without first explaining the local execution risk or obtaining explicit approval for system changes. Restricting this behavior to first-time setup reduces its frequency, but an Instatus request should not implicitly authorize arbitrary local installer execution.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources