Security audit
Security checks for vulnerabilities and agentic risk
The SmartRecruiters functions fit the stated purpose, but setup can execute unchecked remote installers and introduce broader agent changes without clear user control.
Review setup before installing. Use a reviewed, pinned CLI release and require approval for software installation or changes to other agent skills. Consider disabling the CLI's automatic skill synchronization. OOMOL will mediate access to recruitment data; the remote installers and hosted connector implementation were not verified.
The supplied command performs remote installer execution, not the declared SmartRecruiters data access. Nothing in the supplied chunk establishes that this installation is a supporting dependency for SmartRecruiters functionality. The downloaded script is not provided, so its additional behavior cannot be assessed.
Piping an HTTPS response directly into bash executes mutable remote content without a pinned version or independent integrity check. Compromise of the distribution endpoint or its publishing pipeline could execute attacker-controlled code with the agent's local permissions; this is the same underlying installation risk highlighted by SQP-2, not evidence that the vendor is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to execute downloaded shell or PowerShell code without an explicit approval checkpoint or integrity verification. Although setup is conditional on a missing CLI, this can turn a read-only data request into local code execution with the agent's permissions if installation is permitted by the runtime.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources