Security audit
Security checks for vulnerabilities and agentic risk
Persona operations have clear approval controls, but setup can execute unverified installer code and introduce persistent changes to other agents’ skills.
Review and install a verified CLI release separately before use. Check its automatic skill installation behavior; the publisher documents OO_SKILLS_SYNC_DISABLED as a control for startup synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Connect only the intended Persona account, understand that OOMOL processes the requests, and retain confirmation before changes. The bundled skill was fully inspected, but the remote installer payloads and deployed connector implementation remain unverified.
The supplied command performs remote script execution associated with Oomol, rather than the declared Persona operations. Nothing in the supplied chunk establishes this installation as a supporting dependency for Persona. The downloaded script's contents and any further effects are not visible.
The curl-to-bash pipeline executes whatever script the remote endpoint currently serves, without pinning or verifying its contents. HTTPS protects transport but does not prevent malicious changes at a compromised publisher or distribution endpoint. The legitimate dependency-installation context explains the command but does not eliminate the potential for local code execution and access to sensitive files.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs execution of downloaded shell or PowerShell code without review, integrity verification, or explicit installation approval. A compromised distribution endpoint could execute arbitrary code with the invoking user's permissions; limiting installation to a missing-CLI error reduces exposure but does not remove the risk. This overlaps with SC2 rather than representing an independent exploit path.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources