Security audit
Security checks for vulnerabilities and agentic risk
Lokalise changes require approval, but setup instructs the agent to execute unverified remote installers without a separate approval step.
Review and approve CLI installation separately, including any changes to other agent skills. Use narrowly scoped Lokalise credentials and retain the required confirmations for updates and deletions. The review concern is uncontrolled setup authority; the inspected artifact does not establish malicious intent.
The supplied command invokes an Oomol-hosted installer, with no visible connection to Lokalise functionality. Although dependency installation can be a supporting implementation detail, the supplied chunk provides no evidence that this installer supports the declared purpose. The remote script's contents and further effects cannot be determined from this code alone.
Piping an HTTPS download directly into bash executes mutable remote content with the invoking user's privileges without prior integrity verification or review. Compromise of the installer distribution channel could therefore lead to local data theft or modification; the legitimate CLI dependency and conditional fallback reduce exposure frequency but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs the agent to install software by executing downloaded scripts without requiring explicit approval for local code execution or system changes. Although setup is conditional and relevant to the workflow, authorization to perform Lokalise operations does not necessarily authorize installing software on the host.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources