Security audit
Security checks for vulnerabilities and agentic risk
The MSG91 workflow is coherent, but its setup fallback executes changeable remote code without a clear approval or verification step.
Review the setup fallback before installing. Prefer a separately approved, verified CLI release and review its automatic skill synchronization. OOMOL will process MSG91 requests through your connected account; confirm recipients and message contents before sending. The remote installer contents were unavailable for inspection, so their precise local effects remain uncertain.
The visible behavior is remote installer execution rather than MSG91 data access or modification. Although installation can be a supporting implementation detail, the supplied content establishes no connection between this Oomol installer and MSG91 functionality. The downloaded script is not provided, so its further behavior cannot be determined.
Piping a mutable remote installer directly into bash executes its contents with the agent process's local privileges, without prior review or integrity verification. The domain is consistent with the documented CLI provider and installation is conditional, but compromise of the distribution endpoint could still enable local data theft or modification; the PowerShell example has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation of local software without explaining that it executes remote code or requiring approval for system changes. Restricting installation to a missing-CLI error reduces exposure, but authorization to perform a MSG91 operation does not necessarily authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources