Security audit
Security checks for vulnerabilities and agentic risk
The DocsBot features fit their stated purpose, but automatic setup executes unverified remote code and can install additional agent skills.
Review the setup before enabling this skill. Provision a reviewed, pinned CLI yourself and decide whether to allow its additional skill installation. The publisher documents OO_SKILLS_SYNC_DISABLED=1 to prevent startup skill synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables). Connect only the intended DocsBot account and understand that requests pass through OOMOL. The remote installers and live connector implementation were not verified.
The supplied command performs remote script execution associated with an Oomol installer, not DocsBot AI search or data retrieval. No relationship to the declared DocsBot functionality is established, so this is an undeclared capability and an inconsistent resource. The contents and additional effects of the downloaded script are not available for assessment.
The supplied chunk performs only a CLI login and contains no DocsBot-specific search or reading functionality. Authentication could support a larger integration, but the supplied code establishes no such connection and does not implement the declared purpose.
Piping an HTTPS response directly into Bash executes whatever the endpoint supplies without an opportunity to inspect or verify it. HTTPS protects transport but not against a compromised publisher or mutable installer, making this a supply-chain execution risk rather than evidence that the OOMOL domain itself is malicious; it is the same underlying issue as the setup-workflow finding.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup instructs the agent to download and immediately execute shell or PowerShell code without reviewing it, verifying a pinned artifact, or obtaining explicit approval for installation. A compromised distribution endpoint or installer could execute arbitrary commands with the agent's operating-system privileges; limiting setup to a missing-CLI error reduces frequency but does not protect that execution path.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources