Security audit
Security checks for vulnerabilities and agentic risk
OpenStatus changes require approval, but the CLI setup can execute unverified code and introduce persistent agent skills beyond the stated task.
Review the CLI installer and its additional agent-skill installation behavior before proceeding. The publisher documents startup synchronization controls in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Connect only the intended OpenStatus account through OOMOL and retain the skill's approval requirements for changes and deletions. Review is warranted by the setup scope; no malicious behavior was established.
The supplied command installs software from Oomol, with no visible OpenStatus interaction or evidence that this installation supports the declared functionality. Remote script execution is a material capability absent from the description. The fetched script's contents and further effects cannot be determined from this chunk.
The setup instructions pipe a remotely fetched, unpinned script directly into Bash without reviewing or independently verifying its contents; the PowerShell alternative uses the same download-and-execute pattern. Compromise of the distribution endpoint or publishing pipeline could therefore execute arbitrary code with the invoking user's permissions, exposing local files and credentials. Its restriction to missing-CLI setup reduces exposure, but does not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources