Security audit
Security checks for vulnerabilities and agentic risk
Opsgenie changes require approval, but first-time setup can execute an unverified remote installer without asking first.
Review the setup path before enabling this skill. Install a verified, fixed CLI release yourself and check its automatic skill-synchronization settings. OOMOL mediates Opsgenie access; the remote installers and server-side implementation were not verified.
The supplied code installs software from an Oomol endpoint rather than performing an Opsgenie operation. Nothing in the supplied chunk establishes this installation as a supporting dependency for the declared purpose. The remote script's contents are not supplied, so its further behavior cannot be assessed.
Piping a downloaded script directly into Bash executes mutable remote content with the agent process's local privileges, without a pinned version or independent integrity verification. HTTPS protects transport but does not prevent a compromised distribution endpoint from delivering malicious code; the missing-CLI condition limits when this occurs, not its potential impact, and the PowerShell example has the same issue.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without requiring approval for executing an installer or changing the local environment. Restricting this to a command-not-found error reduces exposure, but a request to operate Opsgenie does not inherently authorize local software installation; the write-confirmation rules only explicitly cover Opsgenie state.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources