Security audit
Security checks for vulnerabilities and agentic risk
Review is warranted because setup directly executes downloaded code and profile actions may expose an API token despite assurances otherwise.
Review and explicitly approve CLI installation using a verified, pinned release. Use a narrowly permissioned Paperless-ngx account and understand that OOMOL mediates document access. Avoid profile actions until API tokens are filtered before reaching the agent. The supplied files establish these concerns but do not establish malicious intent or verify external runtime behavior.
The supplied command performs remote software installation rather than any visible Paperless-ngx operation. Nothing in the supplied content establishes this installer as a supporting dependency for Paperless-ngx. The downloaded script is not provided, so its further behavior cannot be assessed.
The curl-to-bash command immediately executes mutable remote content without a pinned version or independent integrity verification; the PowerShell alternative has the same weakness. A compromised installer host or release pipeline could execute attacker-controlled code with the agent's local privileges, although there is no evidence that the current installer is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The documented get_profile and update_profile responses include the API token, contradicting the assurance that the agent never handles raw tokens. If those responses reach the agent as described, credentials can enter model context, transcripts, or downstream outputs; redaction from logs alone does not prevent this exposure.
The missing-CLI fallback directs installation without explicit approval, extending a Paperless-ngx request into local code execution and environment modification. The confirmation rules only cover tagged connector actions, so they do not clearly protect this setup path; the error-triggered condition reduces frequency but not the potential consequence.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources