Security audit
Security checks for vulnerabilities and agentic risk
Calendar operations have sensible safeguards, but setup can execute changing remote software without clear approval and may introduce broader agent changes.
Review and install the CLI separately before using this skill, including its automatic agent-skill installation and synchronization. Understand that OOMOL mediates calendar access, and retain confirmation for changes and deletions. The remote installers were unavailable for inspection; no malicious behavior was established.
The supplied chunk performs remote software installation rather than Teamup Calendar operations. Nothing shown establishes that this installer is a supporting dependency for the declared calendar functionality. The downloaded script's contents and further effects are not available for assessment.
Piping an HTTPS response directly into bash executes mutable remote content with the invoking user's privileges, without a pinned artifact or independent integrity verification. Compromise of the distribution endpoint or installer could therefore lead to local code execution and access to user-readable data; the PowerShell alternative has the same underlying risk, although there is no evidence the current installers are malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback instructs installation through immediate execution of downloaded shell or PowerShell code without requiring informed approval for local code execution and system changes. The conditional setup path and declared oo-only tool allowance reduce immediate exposure, but the installation instructions themselves lack an explicit approval gate.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources