Security audit
Security checks for vulnerabilities and agentic risk
The Textmagic workflow has appropriate approval controls, but its setup fallback can execute downloaded code without separate user approval.
Review and approve CLI installation separately, including changes to installed agent skills, and prefer a verified release. OOMOL mediates access to your Textmagic account; confirm SMS recipients, content, and charges before sending. Remote installer and service implementations were not verified; the artifact provides no evidence of malicious intent.
The supplied code installs external software rather than reading, creating, or updating Textmagic data. No visible code establishes that this installer is a supporting dependency for Textmagic. The remote script's contents are not supplied, so its further behavior cannot be determined.
The curl-to-bash pipeline executes whatever script the HTTPS endpoint returns without pinning a version or verifying artifact integrity. Compromise of the distribution endpoint could therefore become arbitrary local code execution; this is the same underlying installer risk identified by SQP-2, not a separate exploit chain.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without requiring informed approval or verifying the downloaded artifact. A compromised installer source could execute arbitrary code with the invoking user's privileges; limiting this behavior to missing-CLI errors reduces exposure but does not remove the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources