Security audit
Security checks for vulnerabilities and agentic risk
The Linear workflow is coherent, but its setup directs execution of unverified downloaded code without a separate installation approval step.
Review and approve CLI installation separately, including any changes to other agent skills. Prefer a reviewed, fixed release and grant only necessary Linear permissions. OOMOL mediates the connection and requests; the remote installer and server-side credential protections could not be verified.
The supplied command installs software from an external Oomol endpoint; it does not show any Linear MCP operations or establish that this installation supports them. Remote installer execution is a material capability not represented by the declared description. The downloaded script's further behavior cannot be determined from this chunk.
The supplied chunk contains no Linear MCP interaction or Linear data operations. Authentication could be a supporting implementation detail, but nothing in this chunk establishes that oo auth login authenticates to Linear or supports the declared workflow.
Piping an HTTPS response directly into bash executes mutable remote code without checking a pinned version, signature, or independently trusted digest; the PowerShell alternative has the same issue. A compromised installation endpoint or release pipeline could execute arbitrary commands with the user's privileges, although the supplied content does not establish that the endpoint is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs installation through remotely downloaded shell or PowerShell code without a separate approval requirement or explanation of host changes. Although conditional and relevant to setup, this expands a Linear data task into code execution with the invoking user's privileges; the Linear write-confirmation rules do not cover this installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources