Security audit
Security checks for vulnerabilities and agentic risk
The Mintlify actions have clear approval controls, but setup executes unverified installers and the required CLI can silently install persistent agent skills.
Review the CLI installation before allowing setup, and use a verified release. Consider disabling its automatic skill synchronization before running commands. OOMOL will mediate your connected Mintlify access, and deployments require confirmation. The installer and hosted connector implementations are outside the supplied artifact and were not verified.
The supplied command executes code from Oomol, not Mintlify, and shows no Mintlify interaction or evidence that this installation supports the declared purpose. The downloaded script's contents and downstream effects are not supplied, so those effects cannot be assessed.
Piping the HTTPS response directly into bash executes whatever code the installation endpoint supplies, without pinning or independently verifying the artifact. Compromise of the vendor's distribution infrastructure could therefore lead to local code execution and access to user-readable secrets; the legitimate dependency relationship and conditional setup reduce suspicion but do not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute downloaded shell or PowerShell code without an explicit installation-approval step or independent integrity verification. Missing warning text alone is not the core vulnerability: the danger is running mutable remote code with the invoking user's privileges, although the missing-CLI condition limits exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources