Security audit
Security checks for vulnerabilities and agentic risk
The WP Maps workflow includes appropriate approval controls, but its fallback setup executes unverified remote code without a separate approval step.
Review or independently install the CLI before use, including its automatic agent-skill synchronization behavior. Require approval before running the fallback installer, and retain the skill's confirmation requirements for writes and deletions. WP Maps operations pass through OOMOL. The sole bundled file was fully inspected; remote installer and connector behavior remain unverified.
The supplied code performs remote software installation rather than WP Maps operations. Although installing a dependency can be a supporting implementation detail, this chunk provides no evidence that the Oomol installer supports the declared WP Maps functionality. The downloaded script's contents and any further effects are not available for assessment.
The command pipes an unpinned network response directly into Bash, allowing the remote endpoint to supply arbitrary code running with the agent process's privileges. HTTPS and the legitimate dependency context reduce some risks but do not protect against a compromised distribution endpoint or malicious installer update; the PowerShell example has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by executing downloaded code without requiring informed user approval for local execution and system changes. Limiting this to a missing-CLI error reduces exposure, but authorization to manage WP Maps records does not necessarily authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources