Security audit
Security checks for vulnerabilities and agentic risk
The email operations have clear safeguards, but automatic dependency setup executes unverified downloaded code without clear user approval.
Review setup before installing: approve and verify the CLI separately, and check whether it adds or updates other agent skills. OOMOL mediates SMTP2GO requests and manages the connected credentials. Keep the required confirmation of recipients and email content. The remote installer and hosted connector implementation were not verified; this Review verdict concerns setup control, not demonstrated malicious behavior.
The supplied code runs an Oomol-hosted installation script rather than performing SMTP2GO operations. Nothing in the chunk establishes that this installer supports the declared SMTP2GO functionality. The downloaded script's contents and subsequent behavior are not available for assessment.
The command streams a mutable remote installer directly into bash without independent integrity verification or review; the PowerShell alternative follows the same execution pattern. If the distribution endpoint or release pipeline is compromised, attacker-controlled code could execute with the invoking user's privileges, although the vendor-related HTTPS endpoint and missing-CLI prerequisite reduce exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to install software without first obtaining approval for third-party code execution and local system changes. Its conditional nature reduces exposure, but authorization to perform an SMTP2GO task does not necessarily authorize installing software on the host.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources