Security audit
Security checks for vulnerabilities and agentic risk
The LiveAgent workflow has clear safeguards, but its automatic setup can execute unverified software and introduce broader agent changes.
Review and approve the CLI installation separately before allowing automatic setup. Check its bundled-skill synchronization behavior and disable it if unwanted. Connect only the LiveAgent permissions you need, understanding that OOMOL handles the integration's credentials and data. The downloaded installers and hosted connector implementation were not verified.
The supplied command executes an Oomol installation script rather than implementing a LiveAgent operation. No connection between this installer and the declared LiveAgent functionality is established, so it cannot be treated as a demonstrated supporting implementation detail. The downloaded script's contents and further effects are not visible in this chunk.
Piping the HTTPS installer directly into bash gives the remote response immediate code execution with the invoking process's privileges. HTTPS protects transport but does not protect against a compromised distribution endpoint or malicious publisher update; this is the same underlying installation weakness identified by SQP-2, not a separate exploit chain.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without inspecting it, verifying an independently trusted integrity value, or obtaining explicit installation approval. A compromised installer endpoint or malicious installer update could execute arbitrary code with the agent's local privileges; limiting this to missing-CLI failures reduces exposure but does not remove the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources