Security audit
Security checks for vulnerabilities and agentic risk
The notification workflow requires confirmation, but setup can execute remote installers and introduce lasting agent changes without separate approval.
Review and approve CLI installation separately, verify the release, and decide whether OOMOL may install or refresh other agent skills. Disable startup skill synchronization if unwanted. Confirm notification recipients and content, and understand that OOMOL handles the provider connection. External installers and live connector implementation remain outside the inspected artifact.
The supplied code performs an Oomol CLI installation rather than the declared Push by Techulus data operations. Nothing in the provided chunk establishes this installation as a supporting dependency of that integration. The installer contents are not supplied, so its further effects cannot be determined.
The supplied chunk performs only an authentication command and shows no Push by Techulus integration or data operations. Authentication could be a supporting implementation detail, but nothing in this chunk establishes that oo auth login authenticates to the declared service.
Piping a mutable HTTPS response directly into Bash executes remote code without a pinned version or independent integrity verification. A compromised distribution endpoint could execute commands with the invoking user's permissions; the legitimate dependency context and missing-CLI condition reduce exposure but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs the agent to execute downloaded shell or PowerShell code without explaining the local changes or requiring installation approval. This is limited to a missing-CLI condition, but it can still turn an ordinary notification request into local software installation and arbitrary code execution if the installer is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources