Security audit
Security checks for vulnerabilities and agentic risk
The Nylas read workflow is coherent, but automatic setup executes unverified remote code and leaves broader installation effects unclear.
Review and verify the CLI installation before allowing automatic setup, including whether it installs or updates other agent skills. Connect only the intended Nylas account with necessary permissions. The complete bundled artifact was inspected, but remote installer behavior and server-side credential handling remain unverified.
The supplied code contains no Nylas operations; its sole behavior is downloading and executing an Oomol installer. Nothing supplied establishes that this installation supports the declared Nylas functionality. The installer's downstream actions cannot be determined from this chunk.
Authentication could support a Nylas integration, but the supplied chunk contains only a login command, with no demonstrated Nylas connection or data-access behavior. As supplied, its primary behavior does not match the declared purpose. The command alone does not establish which service or account is accessed.
The setup instructions pipe a remotely fetched, unpinned script directly into Bash without verifying its integrity or reviewing its contents; the PowerShell alternative has the same execution pattern. Compromise of the installer endpoint or its delivery infrastructure could execute arbitrary code with the agent process's local permissions, exposing files and credentials. The missing-CLI condition limits when this occurs, and the vendor domain is contextually appropriate, but neither protects against a compromised installer.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources