Security audit
Security checks for vulnerabilities and agentic risk
The Laravel Cloud functions fit the stated purpose, but automatic setup executes unverified remote code without clearly controlling its local changes.
Review and approve CLI installation separately before allowing this skill's setup fallback. Check whether the chosen CLI release installs or updates other agent skills, and disable that behavior if unwanted. Use only the Laravel Cloud permissions needed and understand that OOMOL mediates account access. The remote installer and resulting release were not verified.
The supplied command performs remote code execution for an apparent Oomol CLI installation, not Laravel Cloud searching or reading. Nothing in the supplied content establishes this installation as a supporting dependency for Laravel Cloud access. The downloaded script is not supplied, so its specific downstream actions cannot be determined.
Piping an HTTPS response directly into Bash executes mutable remote content without a review or integrity-verification step. A compromised installation endpoint or release pipeline could therefore execute arbitrary code with the agent's local privileges; the legitimate dependency-setup context explains the command but does not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs an agent handling a read-only Laravel Cloud request to execute a remote installer without explicit approval or an explanation of local system changes. Although conditional on a missing CLI, both installation variants execute downloaded code with the invoking user's privileges, potentially exposing accessible files and credentials if the installer is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources