Security audit
Security checks for vulnerabilities and agentic risk
The Svix workflow is coherent, but missing-tool setup executes remote code without a separate approval or integrity check.
Review setup before enabling this skill. Install a verified CLI release yourself, inspect its agent-skill synchronization settings, and connect only the Svix account you intend to use. OOMOL mediates requests and credentials. All bundled content was inspected, but the remote installers and deployed connector implementation were not verified.
The supplied command installs software from Oomol, while the description presents a skill for managing Svix data. Nothing in the supplied chunk establishes this installation as a supporting dependency for Svix. The downloaded script is not provided, so its further behavior cannot be assessed.
The command pipes a mutable remote script directly into Bash without an independent integrity check or review; the PowerShell alternative uses the same download-and-execute pattern. A compromised distribution endpoint or malicious installer update could execute arbitrary code with the agent's local permissions, potentially accessing files and credentials. The documented vendor domain and conditional setup reduce suspicion of malicious intent but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by executing downloaded code without explaining the local changes or obtaining explicit installation approval. Although restricted to first-time setup, this expands a Svix task into local code execution; the confirmation requirements for Svix writes do not explicitly cover installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources