Security audit
Security checks for vulnerabilities and agentic risk
The MemberVault actions are clearly controlled, but fallback setup runs downloaded code without separate approval or integrity verification.
Review setup before enabling this skill. Install a reviewed CLI yourself, require approval before downloaded code runs, and decide whether to disable its automatic skill synchronization. OOMOL will handle your MemberVault credentials and operation data. Keep the skill's confirmation requirements for account changes and deletions. The remote installers and hosted backend were not verified.
The supplied chunk contains only a remote installer execution command, with no MemberVault API calls or data operations. Nothing in the supplied content establishes this installer as a supporting dependency for MemberVault, so its behavior materially differs from the declared purpose. The downloaded script's additional effects cannot be determined from this chunk.
The only supplied behavior is an oo login command, whereas the description presents a MemberVault data-management skill. Authentication could support such an integration, but the supplied chunk provides no connection between this CLI and MemberVault. The mismatch is the unsubstantiated service and purpose alignment, not authentication itself.
Piping a mutable remote script directly into Bash executes its contents with the agent process's privileges without prior inspection or independent integrity verification. HTTPS and the documented vendor domain reduce some risks but do not protect against a compromised distribution endpoint; the PowerShell alternative has the same exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software when the CLI is missing without requiring user approval or explaining that downloaded code will run and may change the local environment. The error-triggered condition limits when this occurs, but approval to perform MemberVault operations does not necessarily authorize local software installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources