Security audit
Security checks for vulnerabilities and agentic risk
Mailtrap actions have clear approval controls, but setup directs the agent to execute an unverified remote installer without separate consent.
Review and approve CLI installation separately using a verified release. Consider OOMOL's access to your Mailtrap data and the CLI's broader agent-skill synchronization before proceeding. Keep the explicit change and deletion confirmations. The remote installer and hosted connector were not inspected; no malicious behavior was established.
The supplied code contains no Mailtrap operations or demonstrated Mailtrap integration. Its sole action is executing an installer hosted by Oomol, an undeclared capability with no established supporting role in the stated purpose. The downloaded script's further behavior cannot be determined from this chunk.
The command pipes a remotely fetched, mutable script directly into Bash without a pinned version or independent integrity verification; the PowerShell alternative has the same trust issue. If the distribution endpoint or publishing pipeline is compromised, the script could execute arbitrary commands with the invoking user's permissions, potentially exposing local secrets or modifying files.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing, without explicitly obtaining approval for local code execution or explaining the resulting system changes. Although limited to first-time setup, this can turn an ordinary Mailtrap request into execution of downloaded code with the agent process's local permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources