Security audit
Security checks for vulnerabilities and agentic risk
The Workiz features fit the stated purpose, but setup directs the agent to execute downloaded software without a separate review or approval step.
Review before installing. Approve CLI installation separately, use a reviewed release with verified integrity, and check its automatic skill synchronization settings. Connecting Workiz also entrusts OOMOL with access to business records and account credentials. The concern is insufficient control over setup effects; the inspected artifact does not establish malicious behavior.
The supplied code executes an Oomol-hosted installer, with no demonstrated connection to Workiz. Although dependency installation can be a supporting implementation detail, this chunk provides no evidence that the installer supports the declared functionality. The downloaded script's further behavior cannot be determined from the supplied code.
Piping an HTTPS response directly into Bash executes mutable remote content without a pinned version or independent integrity verification. A compromised distribution endpoint or altered installer could execute arbitrary commands with the user's privileges, potentially exposing local secrets or modifying files; the conditional setup context reduces exposure but does not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs an agent performing a read-oriented Workiz task to install software locally without first explaining the system changes or obtaining approval. Although triggered only when the CLI is missing, both installation examples execute downloaded code with the invoking user's privileges, extending the task beyond remote data access.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources