Security audit
Security checks for vulnerabilities and agentic risk
The Talenox read operations fit the stated purpose, but automatic setup executes unverified remote code without a clear user approval step.
Review and approve CLI installation separately before using this skill. Prefer a verified, fixed release and review its automatic skill synchronization settings. Connecting Talenox allows OOMOL to handle credentials and sensitive employee data. The installer and hosted connector were not available as bundled code for verification; no malicious behavior was established.
The supplied code performs remote installer execution rather than searching or reading Talenox data. Although installation can be a supporting implementation detail, this chunk establishes no connection between the Oomol installer and the declared Talenox functionality. The downloaded script's contents and further effects cannot be determined from the supplied code.
The curl-to-bash command executes a mutable remote script without a pinned version, independently verified digest, or signature check; the PowerShell example follows the same download-and-execute pattern. HTTPS protects transport but does not prevent a compromised distribution endpoint or release process from supplying code that could access local files and credentials with the agent's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to execute a downloaded installer without requiring informed user approval or explaining that it can modify the local system. The conditional setup trigger reduces exposure, but a request to read Talenox data should not implicitly authorize running arbitrary installer code with the agent's local privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources