Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because its setup directs the agent to run an unverified remote installer without first asking you.
Review and approve CLI installation separately, verify the downloaded software, and review or disable its bundled-skill synchronization before use. Connect only the Quipteams access you need and consider the employee and business data available through OOMOL. The sole bundled artifact was fully inspected, but the remote installer contents and exact local effects remain unverified. No artifact-backed malicious intent or exfiltration was found.
The supplied code performs remote installer execution, not the declared Quipteams search/read functionality. Although installation can be a supporting implementation detail, this chunk establishes no relationship between the Oomol installer and Quipteams. The downloaded script's contents and resulting system changes cannot be determined from the supplied code.
Piping a downloaded installer directly into Bash executes mutable remote code without independently verifying its integrity; the PowerShell alternative has the same issue. If the distribution endpoint or its supply chain is compromised, this can execute attacker-controlled code with the agent's local privileges, despite the legitimate dependency-setup context.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software after a missing-command error without first obtaining approval for local code execution and system changes. Its conditional nature limits exposure, but a request to read Quipteams data does not itself authorize installing software on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Quipteams homepage: https://www.quipteams.com
- API documentation: https://api.quipteams.com/docs