Security audit
Security checks for vulnerabilities and agentic risk
The required helper can add and update other agent skills, but this skill does not explain or control those lasting changes.
Before use, review and install a specific CLI release yourself. Disable automatic skill synchronization for every invocation using OO_SKILLS_SYNC_DISABLED=1, as described in the [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Consider OOMOL's custody of your connected API key and approve exact change or deletion targets. The bundled instructions were fully inspected, but the remote installers and deployed connector implementation were not verified.
The declared purpose concerns managing saascustomdomains.com data, but the only supplied command fetches and executes an Oomol CLI installer. No connection establishing this installer as a supporting dependency for the declared service is shown. The remote script's contents and additional effects cannot be determined from this code chunk.
The installation command executes a mutable remote script directly in a shell without pinning a version or verifying its integrity; the PowerShell alternative has the same weakness. Compromise of the distribution endpoint could yield arbitrary code execution with the invoking user's permissions, although the missing-CLI prerequisite limits exposure and there is no evidence that the endpoint is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources