Security audit
Security checks for vulnerabilities and agentic risk
Tapfiliate actions have clear approval controls, but setup can execute unverified downloaded code and introduce broader agent changes without clear user approval.
Review and approve CLI installation separately, including whether it may install or synchronize other agent skills. Check OOMOL's access to your Tapfiliate account and retain write confirmations. The remote installer contents could not be inspected; no malicious payload was established.
The supplied code performs remote script execution rather than any visible Tapfiliate operation. Dependency installation can be a supporting implementation detail, but the supplied chunk establishes no connection between this Oomol installer and the declared Tapfiliate functionality. The downloaded script's contents and resulting actions are not available for assessment.
The curl-to-bash pipeline immediately executes whatever script the remote endpoint supplies, without version pinning or independent integrity verification. Compromise of the distribution endpoint could therefore execute malicious code with the user's permissions, potentially exposing local credentials or files; the legitimate dependency and conditional setup reduce exposure but do not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct execution of downloaded shell or PowerShell code without requiring informed approval or verification of the downloaded artifact. Although limited to first-time setup, this can turn an ordinary Tapfiliate request into local code execution and system changes with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources