Security audit
Security checks for vulnerabilities and agentic risk
The Z-API workflow is coherent, but its automatic setup can execute unverified installation code and introduce broader agent changes without clear user approval.
Review and verify the CLI installation separately before letting the agent perform setup. Decide whether to permit its automatic installation and synchronization of other agent skills; upstream documents controls in the [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Confirm message recipients and content, and understand that requests pass through OOMOL. The downloaded installer and server-side connector implementation were not verified.
The supplied command executes a remote Oomol installation script, with no visible Z-API interaction or established connection to the declared purpose. Installing unrelated tooling is a materially different capability, not a demonstrated supporting implementation detail. The contents and further effects of the downloaded script are not available in the supplied code.
The supplied chunk performs a CLI login rather than the declared Z-API operations. Authentication could be a supporting implementation detail if tied to Z-API, but the supplied content establishes no such connection. The assessment is limited to this chunk; it does not establish what service oo authenticates to.
Piping an HTTPS response directly into Bash executes a mutable remote script without checking a pinned version, signature, or independently trusted digest. HTTPS protects transport but does not prevent a compromised distribution endpoint from serving malicious code; conditional use for legitimate setup reduces exposure but does not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs installation through downloaded shell or PowerShell code without an explicit approval gate for executing remote code or changing the local system. Although this is relevant dependency setup and only occurs conditionally, following it could execute attacker-controlled code with the invoking user's privileges if the distribution source is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources