Security audit
Security checks for vulnerabilities and agentic risk
Review the setup before use: it executes changing remote installers, and the required CLI can install other agent skills without this skill explaining those changes.
Before using the skill, install a reviewed, verified CLI release and decide whether to allow its additional skill installations. Upstream documents OO_SKILLS_SYNC_DISABLED=1 to disable startup synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Only submit content you intend OOMOL and JigsawStack to process. The review concern is insufficient control over setup and persistent changes; the artifact does not establish malicious intent.
The supplied command executes a remote installer from a different service. Neither installation nor remote shell execution is disclosed in the declared purpose, and the chunk shows no JigsawStack interaction or evidence that this installer is a supporting dependency. The downloaded script's contents and any further effects are not available for assessment.
The supplied chunk only performs a login operation; it contains no JigsawStack search or data-reading behavior. Authentication could be a supporting implementation detail if tied to JigsawStack, but the supplied content establishes no such connection.
The fallback installation command downloads a mutable remote script and immediately executes it without version pinning, independent integrity verification, or review; the PowerShell alternative has the same issue. Compromise of the distribution endpoint or release pipeline could execute attacker-controlled code with the agent process's permissions, although the missing-CLI condition limits when this path is reached.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The workflow instructs the agent to submit action payloads through OOMOL to JigsawStack, including potentially private content for text-processing actions. Although the connector is identified, the skill does not warn about disclosure of submitted content and instead labels all untagged actions safe to run directly; read-only operations can still affect privacy.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources