Security audit
Security checks for vulnerabilities and agentic risk
Rentman access matches the stated purpose, but setup runs downloaded installation code without a clear approval step or limits on broader agent changes.
Review and approve CLI installation separately before allowing setup to proceed. Understand that OOMOL mediates access to your Rentman account. Review the CLI's automatic skill synchronization and its documented controls before use. The remote installers could not be inspected, so their exact changes remain uncertain; the supplied artifacts do not establish malicious intent.
The supplied code performs remote software installation rather than Rentman data access. Although installation can be a supporting implementation detail, the chunk establishes no relationship between the Oomol installer and Rentman functionality. The downloaded script's further behavior cannot be determined from the supplied code.
The command executes a mutable remote script with the local user's privileges without checking a pinned version, signature, or trusted digest. If the distribution endpoint or release pipeline is compromised, the script could access local credentials, modify files, or establish persistence; the PowerShell alternative has the same issue. HTTPS and conditional installation reduce some exposure but do not verify the script's integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by immediately executing downloaded code, without requiring approval for that system-changing operation. A Rentman read request does not itself authorize arbitrary local software installation; although the missing-CLI condition limits exposure, it does not establish user consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Rentman homepage: https://rentman.io
- API documentation: https://api.rentman.net/