Security audit
Security checks for vulnerabilities and agentic risk
Sender account changes require approval, but setup can execute unchecked downloaded code and the required CLI can make undisclosed changes to installed agent skills.
Review the CLI installation before proceeding and use a reviewed, fixed version. Set OO_SKILLS_SYNC_DISABLED=1 to prevent the documented startup skill synchronization. Consider whether OOMOL should process your Sender subscriber data, and retain the required approvals for account changes. The downloaded installers and exact installed CLI version could not be verified.
The supplied chunk performs remote script installation, not Sender data management. Installation can be a supporting implementation detail, but this chunk provides no evidence that the Oomol installer supports the declared Sender functionality. The downloaded script's contents and further effects are not visible.
The command executes a mutable remote script directly in Bash without verifying its integrity or reviewing its contents; the PowerShell alternative uses the same download-and-execute pattern. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges, although installation runs only when the CLI is missing and enforced tool restrictions may block it.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software without explaining that it will execute remote code or requesting approval for local system changes. This crosses beyond ordinary Sender operations, although the fallback is conditional and the declared tool restrictions may prevent execution.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Sender homepage: https://www.sender.net
- API documentation: https://api.sender.net/