Security audit
Security checks for vulnerabilities and agentic risk
The analytics workflow fits its purpose, but its setup instructions can execute downloaded code without a clear user approval step.
Review the setup path before installing. Install oo yourself from a reviewed, version-verified release and check its automatic agent-skill changes. Connect only the intended Umami account, understanding that access runs through OOMOL. Remote installer contents were unavailable for verification; this review concern does not establish malicious behavior.
The supplied command executes an external installer and performs no visible Umami data operations. Nothing in the supplied content establishes that this installer is a supporting dependency for Umami access. Its remote execution and installation behavior therefore materially differs from the declared purpose. The downloaded script's exact effects cannot be determined from this code chunk.
The command pipes a remotely fetched, unpinned script directly into Bash, allowing its contents to execute with the invoking user's permissions without integrity verification or review. Compromise of the distribution endpoint could therefore lead to credential theft or local tampering; HTTPS and the legitimate setup context do not prevent this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to execute a remote installer without explicitly obtaining consent for local code execution and system changes. Its conditional placement reduces exposure, and the declared tool allowlist may prevent execution if strictly enforced, but an analytics request alone does not authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources