Security audit
Security checks for vulnerabilities and agentic risk
The Jumpseller workflow requires approval for store changes, but its fallback setup directly executes downloaded code without verification or a separate approval step.
Review setup before enabling this skill. Preinstall a reviewed, verified CLI instead of allowing the fallback download-and-execute commands, and review its additional agent-skill installation behavior. Limit the connected account's access and retain confirmations for store changes. The downloaded installers and hosted connector implementation remain unverified.
The supplied chunk performs remote script execution rather than any visible Jumpseller operation. Although CLI installation could be a supporting implementation detail, nothing supplied establishes this installer's relationship to Jumpseller. The downloaded script's contents and further behavior are not available for assessment.
Piping a mutable HTTPS response directly into bash executes remote code with the agent process's privileges without verifying its integrity or reviewing its contents. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from serving malicious code; the PowerShell example has the same underlying issue.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute remotely supplied shell or PowerShell code without an explicit approval step for local installation. Although restricted to missing-CLI errors, this expands a Jumpseller data task into local code execution, potentially exposing files and credentials if the installer or its distribution infrastructure is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources