Security audit
Security checks for vulnerabilities and agentic risk
The Statuspage functions are clearly scoped, but setup can execute unverified remote software and the required CLI can install additional agent skills.
Review the CLI installation before allowing setup, and use a verified release. Consider disabling its automatic skill synchronization using the vendor's documented control. Connect only the Statuspage account and permissions you intend to use, and retain the skill's approval requirements for changes and deletion. The external installer and CLI were not executed or fully verified; no malicious behavior was established.
The visible code runs an Oomol-hosted installer rather than performing Statuspage operations. Nothing supplied establishes this installation as a supporting implementation detail for Statuspage access. The downloaded script's contents are unavailable, so its further actions cannot be determined.
The command executes a mutable network-delivered script directly in Bash without a pinned version or independent integrity verification; the PowerShell alternative has the same weakness. Compromise of the installer distribution path could execute attacker-controlled code with the invoking user's privileges, although the legitimate vendor domain and missing-CLI condition provide no evidence of malicious intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI recovery procedure directs installation without explicitly requiring user approval for executing remote code or explaining local system changes. Its conditional placement reduces exposure, but consent to a Statuspage operation does not necessarily authorize installing software on the host.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources