Security audit
Security checks for vulnerabilities and agentic risk
The JumpCloud read functions fit the stated purpose, but automatic setup can execute unverified remote code and introduce broader agent changes without clear user control.
Review setup before enabling this skill. Install a verified CLI release yourself, require approval for software installation, and consider disabling automatic skill synchronization. Connect a minimally privileged JumpCloud account only if you accept OOMOL handling its credentials and data. The remote installers and hosted connector were not verified in this review.
The supplied command executes a remote installer and contains no JumpCloud search or read functionality. Installing unrelated software is not disclosed by the description, and the chunk provides no evidence that this installation supports the declared JumpCloud purpose. The installer’s further behavior cannot be determined from the supplied code.
The command streams a mutable remote script directly into Bash without pinning or independently verifying its contents; the PowerShell alternative has the same issue. Compromise of the distribution endpoint could execute arbitrary code with the invoking user's permissions, exposing local files and credentials. The domain is relevant to the documented CLI and execution is conditional, which reduces suspicion of malicious intent but does not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software without first explaining the system changes or obtaining explicit approval. A user requesting JumpCloud data has not necessarily authorized local software installation; the conditional setup limits exposure but does not establish consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources