Security audit
Security checks for vulnerabilities and agentic risk
Omise operations have clear approval safeguards, but setup can execute unverified downloads and introduce broader changes to installed agent skills.
Review setup before enabling the skill. Prefer a reviewed, pinned CLI installation and explicitly control any bundled-skill deployment across your agents. Connect only the Omise access needed and retain confirmation for customer changes and deletion. The bundled instructions were fully inspected; remote installer contents and hosted credential handling remain unverified.
The supplied chunk performs remote installer execution rather than Omise data operations. Although dependency installation can be a supporting implementation detail, the chunk provides no evidence that this Oomol installer supports Omise functionality. The downloaded script's contents and further effects are not available for assessment.
The curl-to-bash command immediately executes mutable remote content without verifying a pinned version or trusted signature. HTTPS protects transport but does not prevent a compromised installer host or publishing pipeline from delivering malicious code that could access local files and credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions pipe downloaded shell and PowerShell scripts directly into interpreters without review, integrity verification, or explicit installation approval. If the distribution infrastructure is compromised, following these instructions could execute attacker-controlled code with the agent's local permissions; making installation conditional reduces exposure but does not eliminate the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources