Security audit
Security checks for vulnerabilities and agentic risk
Cyberimpact changes require approval, but missing-tool setup directs the agent to execute an unverified remote installer without a separate approval step.
Review and approve CLI installation separately, preferably using a pinned, verified release. Check its broader agent-skill installation behavior before running it. Connecting Cyberimpact authorizes OOMOL-mediated account access; retain the required confirmations for changes and deletions. The packaged instructions were fully inspected, but external installer and CLI behavior remain unverified.
The supplied code performs remote installer execution rather than any visible Cyberimpact operation. Nothing in the chunk establishes this installer as a supporting dependency for the declared purpose. The downloaded script's contents are not supplied, so its downstream behavior cannot be assessed.
Piping an HTTPS response directly into Bash executes mutable remote code without a pinned version or independent integrity verification; the PowerShell alternative has the same weakness. Compromise of the installer host or delivery pipeline could execute arbitrary code with the agent's permissions, exposing accessible files and credentials. The legitimate dependency relationship and conditional setup reduce suspicion of malicious intent but do not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute remote installation scripts without explicit approval for local code execution or disclosure of possible system changes. Restricting this to a missing-CLI error reduces exposure, but a Cyberimpact request does not itself authorize installing software with the agent's local permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Cyberimpact homepage: https://www.cyberimpact.com/
- API documentation: https://api.cyberimpact.com/docs