Security audit
Security checks for vulnerabilities and agentic risk
The Magileads integration is coherent, but its setup instructions can execute unverified remote code without a separate approval step.
Review and approve the CLI installation separately, preferably using a pinned, verified release. OOMOL will mediate access to your connected Magileads account; retain the required confirmations for changes and deletions. The external installer’s full effects were not verified.
The supplied code installs software from Oomol rather than performing the declared Magileads operations. No connection is shown that would establish this installer as a supporting implementation detail for Magileads. The remote script's contents are not supplied, so its further effects cannot be determined.
The command pipes a mutable network response directly into Bash without version pinning or independent integrity verification; the PowerShell alternative has the same execution pattern. Compromise of the installer distribution path could execute attacker-controlled code with the invoking user's permissions, potentially exposing local files and credentials. The domain is relevant to the documented CLI and the fallback is conditional, which reduces suspicion of malicious intent but does not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to execute a remote installer without requiring user approval for local code execution or system changes. Restricting this to a missing-dependency error reduces exposure, but authorization to manage Magileads data does not necessarily authorize installing software on the host.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Magileads homepage: https://www.magileads.com/
- API documentation: https://api.magileads.net/