Security audit
Security checks for vulnerabilities and agentic risk
Mailosaur actions have clear approval controls, but setup directs immediate execution of remote installers and leaves broader agent changes undisclosed.
Review setup before installing. Prefer a pinned, inspected CLI installation, and decide whether its additional agent-skill synchronization is acceptable. The linked documentation provides OO_SKILLS_SYNC_DISABLED to disable startup synchronization. OOMOL mediates Mailosaur access and credentials; use an appropriately limited connection and retain the skill's write/delete approvals. Remote installers and the deployed CLI were not verified.
The supplied command performs remote installer execution rather than Mailosaur data operations. Nothing in the code establishes that the Oomol CLI is a supporting dependency for the declared purpose. The downloaded script's contents are not supplied, so its further behavior cannot be determined.
The supplied code performs only a CLI login and contains no Mailosaur-specific operation or configuration. Authentication could be a supporting implementation detail if the CLI were shown to access Mailosaur, but the supplied chunk establishes no such relationship.
Piping a remotely fetched installer directly into bash executes mutable network-delivered code with the agent process's local permissions, without a pinned version or independent integrity verification. A compromised distribution endpoint could therefore execute arbitrary commands and access local secrets; the missing-CLI prerequisite limits when this happens but does not remove the risk. The adjacent PowerShell installer uses the same unsafe fetch-and-execute pattern.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources