Security audit
Security checks for vulnerabilities and agentic risk
The Sauce Labs workflow has approval controls, but its required software can make broader changes to your agent environment that the skill does not explain.
Review OOMOL's account access and install a verified CLI release yourself before use. If you do not want additional agent skills installed or refreshed, the publisher documents OO_SKILLS_SYNC_DISABLED=1 for disabling startup synchronization; set it before invoking oo. Continue confirming job edits, especially visibility changes. The downloaded installer and hosted service implementation remain outside the inspected package.
The supplied command performs remote script execution for an Oomol CLI installer, with no visible Sauce Labs operations or established connection to the declared purpose. This is a materially different capability, not a demonstrated supporting implementation detail. The downloaded script's contents and further effects cannot be determined from this code chunk.
Piping the HTTPS installer directly into Bash executes the server's current response with the agent's local user privileges, without artifact pinning or independent integrity verification. A compromised distribution endpoint could therefore execute malicious code and access local data; this is the same underlying installation risk identified by SQP-2, not evidence that the current installer is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the setup instructions direct the agent to execute remotely fetched shell or PowerShell code without requiring user approval or verifying a pinned artifact. This can turn a Sauce Labs task into local arbitrary-code execution if the installer distribution is compromised; the conditional setup trigger reduces exposure but does not eliminate the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources