Security audit
Security checks for vulnerabilities and agentic risk
Mem operations have clear approval safeguards, but setup can automatically execute unverified downloaded software with effects beyond Mem.
Review and approve the CLI installation separately before allowing automatic setup. Check its changes to other agents' skills and account access. Mem data passes through OOMOL, and permanent deletion remains possible after approval. The downloaded installers and connector service were not verified; no malicious behavior was established.
The declared purpose concerns Mem data management, but the supplied code executes an external installer for an apparently different service. Installation can be a supporting implementation detail, but this chunk establishes no relationship between the Oomol installer and Mem. The downloaded script's contents and any further actions are not available for assessment.
The curl-to-bash command immediately executes mutable remote content without pinning or artifact-integrity verification. HTTPS protects transport but does not protect against a compromised publisher or distribution endpoint, which could supply code that accesses local files and credentials; the legitimate dependency-installation purpose does not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup instructs immediate execution of downloaded shell or PowerShell scripts without requiring informed approval or verification of their contents. If the installer or its distribution infrastructure is compromised, this can execute attacker-controlled code with the invoking user's permissions; restricting installation to a missing-CLI error reduces exposure but does not establish trust.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources