Security audit
Security checks for vulnerabilities and agentic risk
The Linguapop workflow is well scoped, but its setup can execute unverified downloaded code without first asking you.
Review and approve CLI installation separately, preferably using a pinned release with verified integrity. Check whether it installs additional agent skills. OOMOL will mediate your Linguapop requests and connected credentials; confirm candidate details, email delivery, and callback destinations before sending invitations. The reviewed artifact does not establish malicious behavior, but the external installer remains uninspected.
The supplied command performs remote code execution for an apparent Oomol CLI installation, not Linguapop data operations. Nothing supplied establishes this installer as a supporting dependency for Linguapop. The downloaded script's contents are not provided, so its further behavior cannot be assessed.
Piping a live HTTPS response directly into bash executes mutable remote code with the agent process's local privileges, without a pinned artifact or independent integrity verification. Compromise of the installer distribution could expose accessible files and credentials or enable persistence; the Windows download-and-execute alternative has the same underlying risk. The documented dependency and conditional fallback make this plausible setup behavior, but do not eliminate the supply-chain exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to execute an installer without first obtaining approval for running downloaded code and changing the local environment. Confirmation requirements cover Linguapop writes but do not cover local installation, leaving an authorization gap even though this fallback only runs when the dependency is absent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources