Security audit
Security checks for vulnerabilities and agentic risk
Needs review because its setup instructs the agent to run downloaded software without an explicit approval or integrity check.
Before enabling this skill, install a verified, fixed CLI version yourself or require approval before setup runs downloaded code. Review the CLI's automatic agent-skill synchronization and disable unwanted changes. Confirm that OOMOL may process your Laposta data. The complete bundled artifact was inspected, but remote installers and hosted connector behavior remain unverified; no intentional malicious behavior was established.
The supplied code performs remote installer execution, not Laposta data operations. No code or context establishes this installer as a supporting dependency for Laposta, so its behavior is not adequately represented by the declared purpose. The downloaded script's further effects cannot be determined from the supplied chunk.
The command pipes a mutable remote script directly into Bash without pinning or verifying its contents; the PowerShell fallback has the same execution pattern. Compromise of the installer delivery path could execute attacker-controlled code with the agent process's permissions, potentially exposing local files and credentials. The installer is relevant to the connector, but that relevance does not provide code-integrity assurance.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to install software by executing a downloaded script without an explicit approval step. This expands a Laposta data request into local code execution and environment modification; the conditional fallback limits exposure but does not establish user authorization.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Laposta homepage: https://laposta.nl/
- API documentation: https://api.laposta.nl/doc/