Security audit
Security checks for vulnerabilities and agentic risk
Pushsafer actions require approval, but setup can execute unverified downloads and introduce persistent agent skills beyond the disclosed task.
Review CLI setup separately before allowing automatic installation. Prefer a verified release and disable startup skill synchronization if you only want Pushsafer functionality. OOMOL mediates the connected account and requests. The remote installers were unavailable for inspection, so their exact local effects remain uncertain.
The supplied chunk executes an Oomol installer rather than interacting with Pushsafer. Dependency installation can be a supporting implementation detail, but nothing supplied establishes this installer's role in providing the declared Pushsafer functionality. The remote script's contents and any further effects cannot be determined from this chunk.
Authentication could support the declared functionality, but the supplied chunk contains only a generic login command and establishes no connection to Pushsafer. Its demonstrated purpose therefore differs from the declared Pushsafer data-management purpose.
The setup procedure pipes a mutable remote script directly into Bash without pinning or verifying its contents; the PowerShell alternative uses the same download-and-execute pattern. If the distribution endpoint or delivery pipeline is compromised, installer code can execute with the agent's local permissions and access local data or credentials. Restricting installation to a missing-CLI error reduces exposure but does not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources