Security audit
Security checks for vulnerabilities and agentic risk
The skill requires approval before changing Dart data, but its setup fallback directs the agent to run unverified internet installers without first asking.
Review and approve the CLI installation separately, including any bundled agent-skill changes, before allowing setup. Understand that OOMOL mediates access to your connected Dart account, and retain the skill's explicit approval controls for changes and deletions. Remote installer contents and exact installed behavior remain unverified; no malicious intent is established.
The supplied code performs remote installer execution rather than Dart data operations. Nothing in the provided chunk establishes that this installer supports the declared Dart functionality. The downloaded script's contents and any further effects are not available for assessment.
The only supplied command initiates authentication, with no visible connection to Dart or implementation of its data operations. Authentication could be a supporting implementation detail, but this chunk does not establish that relationship and instead presents login as its entire behavior.
Piping the HTTPS response directly into Bash executes remote code with the invoking user's privileges without a pinned version or independent integrity verification. Compromise of the installer distribution path could expose local credentials and files or enable persistence; the legitimate setup purpose and conditional fallback do not remove that supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute an installer that can modify the local environment without first obtaining approval for those changes. Restricting this behavior to a missing-CLI error reduces exposure, but a Dart data-operation request does not inherently authorize installing software or executing arbitrary installer code.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources