Security audit
Security checks for vulnerabilities and agentic risk
The Devin integration fits its stated purpose, but automatic setup executes unverified remote code and leaves broader changes to agent skills undisclosed.
Review setup before installing. Use a reviewed, pinned CLI installation and check or disable its automatic skill synchronization. OOMOL will mediate Devin requests and credentials; retain confirmation for creating, resuming, or terminating sessions. The installer and hosted connector implementations are outside the bundled artifact and remain unverified.
The supplied command installs software from an Oomol endpoint and contains no Devin operations or evidence that this installation supports Devin functionality. Its apparent primary purpose and accessed resource materially differ from the declared Devin data-management purpose. The remote script's contents are not supplied, so its further behavior cannot be assessed.
The command pipes a mutable remote script directly into Bash without verifying its contents or integrity; the PowerShell alternative has the same weakness. HTTPS protects transport but does not protect against a compromised distribution endpoint or malicious installer update, which could lead to arbitrary code execution under the current user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the setup instructions direct the agent to execute third-party installation code without first obtaining informed approval for local system changes. This goes beyond a Devin data operation and could execute malicious or compromised installer code with the agent process's permissions, although the conditional setup path limits exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources