Security audit
Security checks for vulnerabilities and agentic risk
A Rippling lookup can trigger execution of an unverified software installer without a clear approval step.
Review and approve CLI installation separately, using a verified release, before allowing this skill to run. Check or disable automatic agent-skill synchronization, and connect Rippling with narrowly scoped read permissions. OOMOL mediates access to employee data. The bundled instructions were fully inspected, but external installer behavior remains unverified; no malicious intent was established.
The supplied code installs software from Oomol rather than searching or reading Rippling data. Nothing in the supplied chunk establishes that this installation supports Rippling access. The remote script's contents are not supplied, so its additional behavior cannot be determined.
Piping a mutable remote script directly into Bash executes its contents without a separate verification step; the PowerShell alternative has the same underlying risk. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from supplying code that accesses local files, credentials, or other resources available to the process.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute downloaded installation scripts without first explaining the local execution implications or obtaining installation approval. Although conditional on the CLI being missing, this can expand a read-only data request into execution of external code with the agent process's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources