Security audit
Security checks for vulnerabilities and agentic risk
The WaiverForever integration fits its description, but automatic setup runs downloaded code and leaves broader agent changes insufficiently disclosed.
Review and install the CLI separately before enabling this skill, including any automatic changes to other agent skills. Trusting OOMOL is part of this integration because it handles connected credentials and waiver operations. Keep the exact-payload approval requirement for writes. The remote installer payloads were unavailable for verification; no malicious behavior was established.
The supplied code executes an Oomol installer rather than performing WaiverForever data operations. Although dependency installation can be a supporting implementation detail, the supplied content establishes no relationship between this installer and WaiverForever. The remote script's contents are not provided, so its subsequent behavior cannot be assessed.
Piping a mutable remote script directly into bash executes its contents without prior inspection or independent integrity verification; the adjacent PowerShell command has the same weakness. Compromise of the installer delivery infrastructure could yield arbitrary code execution with the invoking user's permissions, although the expected vendor domain and missing-CLI prerequisite reduce exposure and do not indicate malicious intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup instructs the agent to execute downloaded shell or PowerShell code without first explaining its system-level effects or obtaining installation approval. Although limited to first-time setup, this can turn authorization for a WaiverForever task into unreviewed execution of software with the invoking user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources