Security audit
Security checks for vulnerabilities and agentic risk
The Taggun workflow fits its purpose, but its CLI dependency can automatically install persistent skills beyond Taggun without clearly disclosing that broader change.
Review the CLI dependency before allowing automatic setup, including its installation of other agent skills. Its documented OO_SKILLS_SYNC_DISABLED=1 setting disables startup skill synchronization. Use a reviewed release and submit only document URLs you intend OOMOL and Taggun to process. The bundled instructions were fully inspected, but the remote installer and deployed connector implementation were not verified. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md)
The supplied code contains no Taggun search or read operation. Its sole action is executing an external installer, with no demonstrated connection to the declared Taggun functionality. This is a materially different capability, not an established supporting implementation detail.
Authentication can be a supporting implementation detail, but this chunk provides no evidence that oo auth login authenticates to Taggun or supports its search/read functionality. Its only visible behavior is therefore not aligned with the declared purpose. The command alone does not establish which service is accessed or whether authentication succeeds.
The fallback installation procedure pipes a mutable remote script directly into Bash without pinning or independently verifying the downloaded code; the PowerShell alternative has the same weakness. If the distribution endpoint is compromised, following this procedure can execute attacker-controlled code with the invoking user's privileges, although its conditional setup role and the declared oo-only tool restriction reduce immediate exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The workflow instructs the agent to execute connector actions and labels all untagged actions as safe to run directly. The receipt extraction and validation actions send document URLs to Taggun through OOMOL and enable access to potentially sensitive receipt or invoice contents, but the safety guidance does not disclose this privacy impact.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Taggun homepage: https://www.taggun.io/
- API documentation: https://api.taggun.io/