Security audit
Security checks for vulnerabilities and agentic risk
The Salesflare workflow has clear safeguards, but its setup instructions can trigger an unverified software installation without requiring approval.
Review and approve the CLI installation separately before allowing the missing-tool fallback. Consider OOMOL's access to your CRM and the CLI's documented skill-sync behavior. Keep the required confirmations for record changes. The remote installer and hosted connector implementation were outside the inspected artifact, so their full effects remain unverified.
The supplied chunk performs remote software installation rather than any visible Salesflare operation. Nothing in the description or code establishes the Oomol installer as a supporting dependency for Salesflare access. The downloaded script's contents are not supplied, so its further effects cannot be determined.
Piping a mutable remote script directly into bash executes its contents with the invoking user's privileges without integrity verification or prior inspection. Compromise of the installer distribution path could therefore expose local files and credentials or modify the environment; HTTPS and the legitimate dependency context do not eliminate that supply-chain risk. The adjacent PowerShell download-and-execute command has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation of executable software without requiring informed user approval or explaining potential local-system changes. Although conditional setup limits exposure and the declared tool allowlist may block these commands, a missing dependency should not implicitly authorize running a remote installer.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Salesflare homepage: https://salesflare.com
- API documentation: https://api.salesflare.com/docs