Security audit
Security checks for vulnerabilities and agentic risk
The SupportBee workflow is clearly scoped, but its fallback setup executes changing remote code without clearly limiting or approving local changes.
Review setup before installing. Prefer a separately approved, verified CLI release, and review its automatic skill synchronization. OOMOL mediates access to your SupportBee account and data. Keep confirmation requirements for changes and customer replies. The downloaded installers could not be inspected, so their exact local effects remain uncertain.
The supplied chunk performs remote script execution rather than any observable SupportBee operation. Dependency installation could be a supporting implementation detail, but the provided content establishes no connection between this installer and the declared SupportBee functionality. The downloaded script's contents and further effects are not available for assessment.
The command pipes a mutable remote script directly into bash without version pinning or independent integrity verification. Compromise of the installation endpoint or its publishing infrastructure could execute attacker-controlled code with the agent's privileges; HTTPS protects transport but does not establish that the delivered code is trustworthy.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback workflow directs the agent to execute downloaded shell or PowerShell code without explicit installation approval or disclosure of local-system changes. Although limited to a missing-CLI error, this converts a SupportBee task into local code execution with the agent's privileges; the state-change confirmations elsewhere only address SupportBee data.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources