Security audit
Security checks for vulnerabilities and agentic risk
The Jamie features fit their purpose, but setup runs unverified remote code and the dependency can silently install skills into other agents.
Review the dependency installation before enabling this skill. Prefer a fixed, verified CLI release and disable startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1 unless you want changes across your agents. Connect only the Jamie account you intend to query and consider OOMOL's access to private meeting content. The installer payloads remain unverified; the evidence supports review, not a finding of malicious intent.
The supplied chunk performs a remote installer execution rather than searching or reading Jamie data. Nothing in the chunk establishes that installing the Oomol CLI supports Jamie functionality. The downloaded script's contents and resulting system changes are not visible, so its specific downstream behavior cannot be determined.
The setup command pipes an unpinned remote script directly into Bash without verifying its integrity or reviewing its contents; the PowerShell alternative has the same weakness. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges, potentially accessing local credentials and files. The legitimate dependency and missing-command condition limit exposure but do not make the downloaded code trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources