Security audit
Security checks for vulnerabilities and agentic risk
The timeBuzzer operations have clear safeguards, but setup can execute unverified downloaded code without separate approval.
Review and install a verified CLI separately before using the skill. Check or disable automatic skill synchronization, understand that OOMOL handles the connected account and requests, and retain the required confirmations for changes. The remote installers and hosted implementation were not verified; no malicious behavior was established.
The supplied code performs remote script execution rather than timeBuzzer operations. Nothing in the chunk establishes that the Oomol installer is a supporting dependency for the declared functionality. The downloaded script is not provided, so its subsequent actions cannot be determined.
Piping an HTTPS response directly into bash executes mutable remote content without an artifact integrity check or an opportunity to review it. The domain is a relevant dependency provider, not evidence of malicious intent, but compromise of its delivery infrastructure could lead to local file access, credential theft, or other actions under the executing account; this overlaps with SQP-2 rather than representing a separate attack path.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to execute remotely downloaded shell or PowerShell code without requiring approval for local installation or verifying the downloaded artifact. Although restricted to a missing-CLI error, this allows a timeBuzzer data request to trigger arbitrary code execution with the agent process's permissions if the installer source is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources