Security audit
Security checks for vulnerabilities and agentic risk
A request for an authentication code can trigger an unverified software installer without a separate approval step.
Review and install the CLI separately before allowing this skill to use it, including its automatic skill installation behavior. Confirm that you trust OOMOL with the connected authentication account and generated codes. The remote installers could not be retrieved for inspection, and hosted credential handling is not included in the bundle; their exact behavior remains unverified.
The supplied code performs remote installer execution, not TOTP-related searching or reading. Nothing in the chunk establishes this installer as a supporting dependency for the declared functionality. The downloaded script's contents are unavailable, so its further effects cannot be determined.
The supplied code consists solely of a login command, making authentication its visible primary behavior. Although authentication can support data access, this chunk provides no connection to a TOTP search or read workflow or to rfc-editor.org.
The curl-to-bash pipeline immediately executes mutable remote content without a pinned version or independent integrity verification. HTTPS protects transport but does not protect against a compromised publisher or distribution endpoint, which could deliver code that accesses local files and credentials; the PowerShell alternative has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation through immediate execution of downloaded scripts without requiring informed approval for local code execution or system changes. A missing CLI can therefore escalate a TOTP request into executing installer-controlled code with the invoking user's privileges; the credential-sensitive context increases the potential consequences.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources