Security audit
Security checks for vulnerabilities and agentic risk
TaxJar changes require user approval, but missing software triggers a remote installer without a separate approval step or integrity check.
Review the CLI installation separately before allowing setup, preferably using a pinned and verified release. Consider its effects on other installed agent skills and OOMOL's handling of your TaxJar data. Keep the explicit approvals for account changes and deletions. The artifacts support installation-control concerns, but do not establish malicious behavior.
The supplied command runs an external installer rather than performing TaxJar data operations. Nothing provided establishes this installer as a supporting dependency for TaxJar functionality. The remote script's contents are unavailable, so its specific effects cannot be determined from this code chunk.
The command immediately executes a remotely downloaded script without a pinned version or integrity verification; the PowerShell alternative has the same weakness. If the distribution endpoint or its publishing infrastructure is compromised, attacker-controlled code could execute with the agent process's local privileges and access files or credentials; HTTPS alone does not establish artifact integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software without requiring user approval or explaining that downloaded code will execute and may modify the local environment. Restricting this to a missing-CLI error reduces exposure, but authorization to perform a TaxJar task does not necessarily authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources