Security audit
Security checks for vulnerabilities and agentic risk
This Okta helper needs review because its safety rules allow changes to account access without confirmation.
Require explicit confirmation of the target account and intended effect for every lifecycle operation before using this skill. Connect an Okta account with only the permissions needed. Verify the CLI installer separately and review its automatic skill synchronization behavior. The remote installers and hosted connector implementation were not inspected.
SKILL.mdState-changing user lifecycle operations bypass the documented confirmation gate
Account access can be interrupted or restored before the user confirms the exact target, payload, and effect. Fetching the live input schema does not supply an approval gate. This is a concrete safety-instruction defect, not evidence of a backdoor or intentional attack.
The supplied code executes an installer hosted at cli.oomol.com rather than implementing or invoking identifiable Okta functionality. Dependency installation can be a supporting implementation detail, but this chunk establishes no relationship between the installer and the declared Okta purpose. The downloaded script is not supplied, so its further behavior cannot be assessed.
The lifecycle_user action can activate, deactivate, suspend, unlock, or expire passwords, yet it has no state-changing tag. Because the safety section explicitly classifies untagged actions as reads that are safe to run directly, this omission can cause consequential identity changes without user confirmation.
The instruction permitting untagged actions to run directly inadvertently bypasses confirmation for lifecycle_user. In an identity-management skill, this can disrupt account access or enable accounts without explicit approval; this is the same underlying defect identified by SDI-4, not an independent vulnerability.
The installation command executes a mutable remote script immediately, without version pinning, integrity verification, or review; the PowerShell alternative has the same weakness. Although installation is relevant and limited to a missing-CLI condition, compromise of the distribution endpoint could execute arbitrary code with the agent process's local privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources