Security audit
Security checks for vulnerabilities and agentic risk
The Ongage operations have clear approval controls, but setup can execute unverified installer code and introduce broader agent changes.
Review before installing. Arrange a verified CLI installation separately and review its automatic skill synchronization before first use. Ongage data passes through OOMOL, so connect only the intended account and retain the documented approval checks for changes. The review concern is uncontrolled setup and broader dependency effects; the artifacts do not establish malicious intent.
The supplied code executes an Oomol-hosted installer rather than performing Ongage operations. Nothing in the provided chunk establishes that this installation supports the declared Ongage functionality. The downloaded script's contents and downstream effects are not available for assessment.
The command pipes mutable network content directly into Bash without pinning a version or independently verifying integrity; the PowerShell setup uses the same execution pattern. Compromise of the distribution service could execute arbitrary code with the invoking user's permissions, potentially exposing local credentials and files, although the domain is relevant to the documented connector.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to execute a remote installer without first obtaining approval for local software installation or explaining its effects. This crosses from an Ongage data task into local code execution; the conditional fallback limits exposure but does not authorize those system changes.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources