Security audit
Security checks for vulnerabilities and agentic risk
The JazzHR reads fit the stated purpose, but setup can execute unverified downloaded code and introduce broader changes to installed agent skills.
Review and approve CLI installation separately before allowing setup commands. Use a verified release and consider disabling startup skill synchronization with OO_SKILLS_SYNC_DISABLED=1. Confirm that OOMOL may process your recruiting requests and access the connected JazzHR account. The bundled instructions were fully inspected, but the external installers and CLI runtime were not verified; no malicious intent was established.
The supplied chunk executes an external installer and contains no JazzHR access or data-reading functionality. Nothing supplied establishes this installer as a supporting dependency for the declared JazzHR functionality. The remote script's contents and further effects cannot be determined from this chunk.
Piping an HTTPS response directly into Bash executes mutable remote content with the invoking user's privileges, without artifact verification or a review opportunity. Compromise of the distribution endpoint or installer supply chain could expose local files and credentials or establish persistence; HTTPS and the legitimate dependency context do not protect against a compromised publisher.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs execution of downloaded shell and PowerShell scripts without requiring explicit approval or verification of the downloaded artifact. A missing dependency can therefore escalate a read-only JazzHR request into local code execution and system modification; the missing-command condition limits exposure but does not make the installation safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources