Security audit
Security checks for vulnerabilities and agentic risk
The Jotform workflow is coherent, but setup directs the agent to execute an unpinned remote installer without installation-specific approval.
Review and install a fixed CLI release yourself before use, and review or disable its automatic agent-skill synchronization. Consider whether Jotform submission data may pass through OOMOL, and retain the required confirmation before writes. Exact installer effects remain unverified; no malicious behavior was established.
The visible code installs external tooling rather than accessing Jotform. Installation can be a supporting implementation detail, but the supplied chunk establishes no relationship between this installer and the declared Jotform functionality. The remote installer's contents are unavailable, so its further actions cannot be determined.
Piping an unpinned remote script directly into bash executes whatever the endpoint serves with the invoking user's privileges, without a prior integrity check or review. A compromised distribution endpoint could therefore execute malicious code locally; the PowerShell alternative has the same underlying risk. The legitimate CLI dependency and missing-command prerequisite reduce exposure but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software by executing remote scripts without explaining local execution privileges or obtaining installation-specific approval. Conditioning this on a missing CLI limits exposure, but a Jotform data request does not inherently authorize arbitrary local software installation; actual execution also depends on the host's tool permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Jotform homepage: https://www.jotform.com
- API documentation: https://api.jotform.com/docs/