Security audit
Security checks for vulnerabilities and agentic risk
The Checkly read operations fit the stated purpose, but automatic setup can execute unverified remote code and introduce broader agent changes without clear approval.
Review and approve the CLI installation separately before allowing automatic setup. Decide whether its agent-skill synchronization is acceptable and whether OOMOL may hold your Checkly credentials and process requests. Use a read-only Checkly API key. The bundled instructions show no malicious intent, but the remote installers and resulting executable were not verified.
The supplied chunk runs an installer from a different service and contains no Checkly search or read operations. Nothing supplied establishes this installer as a necessary supporting dependency for Checkly functionality. The remote script's contents and downstream effects are not shown.
Piping a mutable remote script directly into bash executes its contents with the invoking user's permissions without prior verification or review. HTTPS protects transport but does not prevent a compromised distribution endpoint from serving malicious code; the legitimate dependency context and conditional trigger reduce exposure but do not remove that supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs execution of downloaded shell or PowerShell code without explaining that this can modify the host or requesting installation approval. Although conditional and relevant to the workflow, installation crosses a substantially broader trust boundary than reading Checkly data and could expose local files or credentials if the installer is compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources