Security audit
Security checks for vulnerabilities and agentic risk
The Teamcamp features are clearly scoped, but setup can execute downloaded software without a clear user approval step.
Review and install the oo CLI separately before enabling this skill, and require approval for any installer execution. OOMOL will mediate access to your connected Teamcamp account; task comments require confirmation. The external installer contents and their full local effects were not verified.
The visible behavior accesses an Oomol installer endpoint and executes its response, rather than interacting with Teamcamp. Although installing a dependency can be a supporting implementation detail, the supplied content establishes no such relationship here. The downloaded script is not provided, so its further behavior cannot be assessed.
Piping a remotely downloaded script directly into Bash executes mutable external content without reviewing it or independently verifying its integrity; the PowerShell alternative has the same issue. If the installer distribution is compromised, it can execute attacker-controlled commands with the agent's local privileges, potentially exposing files and credentials. The legitimate dependency and conditional fallback explain the purpose but do not eliminate the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without requiring disclosure or explicit approval for local system changes. Although conditional setup reduces exposure, authorization to perform a Teamcamp operation does not necessarily authorize executing an installer on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Teamcamp homepage: https://www.teamcamp.app
- API documentation: https://api.teamcamp.app/api-reference/introduction