Security audit
Security checks for vulnerabilities and agentic risk
The RepairShopr features fit the stated purpose, but setup tells the agent to execute unverified downloaded installers without first obtaining your approval.
Review and approve the CLI installation separately before allowing setup to run, including any automatic agent-skill synchronization. Connect only an authorized RepairShopr account and consider that OOMOL mediates access to customer and ticket data. The remote installer was not available for content inspection, so its exact changes are unverified.
The supplied command installs or bootstraps software from an unrelated service; it contains no visible RepairShopr functionality. Nothing in the supplied chunk establishes this installation as a supporting dependency for RepairShopr access. The downloaded script's contents and further effects are not available for assessment.
Authentication could support a RepairShopr integration, but the supplied chunk contains only a login command and establishes no connection to RepairShopr. As supplied, its primary behavior does not substantiate the declared search-and-read purpose. No credential theft or additional resource access can be inferred from this command alone.
The command streams a mutable remote script directly into Bash without verifying an independently trusted signature or digest; the PowerShell alternative has the same execution pattern. Compromise of the distribution endpoint could execute attacker-controlled code with the agent's local privileges, exposing accessible files and credentials; HTTPS and the conditional setup trigger reduce some exposure but do not verify the delivered code.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to install software by executing remote scripts, without requiring disclosure of system changes or explicit user approval. Although conditional and plausibly legitimate setup, this expands a read-only RepairShopr request into local code execution; the declared tool restriction may limit execution but does not make the fallback instruction safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources