Security audit
Security checks for vulnerabilities and agentic risk
This Gmail skill needs review because setup executes downloaded code immediately and attachment uploads bypass its confirmation safeguards.
Review and approve CLI installation separately, preferably using a verified release. Require confirmation before attachments enter transit storage and check its access and retention rules. Review the CLI's automatic skill synchronization before first use. The remote installers and hosted connector implementation were not verified; no artifact-backed malicious behavior was found.
The supplied chunk performs remote script execution rather than any demonstrated Gmail operation. Although installing a CLI can be a supporting implementation detail, nothing supplied establishes this installer as a Gmail dependency. The remote script's contents are unavailable, so its further behavior and any Gmail functionality cannot be verified.
The setup command executes a remotely fetched, unpinned shell script without inspection or independent integrity verification; the PowerShell alternative has the same weakness. Although installation is a legitimate prerequisite and only occurs when the CLI is missing, a compromised distribution endpoint could execute arbitrary code with the agent's local permissions and expose accessible files or credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The untagged download_attachment action uploads attachment contents to Connector file transit storage, yet the safety section categorizes all untagged actions as reads safe to run directly. This can cause sensitive email attachments to be copied into additional storage without confirmation of that transfer; the existing use of the same connector provider reduces evidence of malicious exfiltration but does not eliminate the privacy risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources