Security audit
Security checks for vulnerabilities and agentic risk
The Fiber AI read operations fit the stated purpose, but setup can execute unverified downloaded software and introduce persistent agent skills without clear user approval.
Review setup before installing. Approve and verify the CLI installation separately, connect only the intended Fiber AI account, and review its automatic agent-skill changes. Upstream documents OO_SKILLS_SYNC_DISABLED as a synchronization opt-out in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Remote installer payloads and server-side connector behavior were not verified.
The supplied command installs software from an Oomol endpoint rather than searching or reading Fiber AI data. Nothing in the supplied chunk establishes this installation as a supporting dependency for the declared purpose. The downloaded script's contents and further effects are not available for assessment.
Piping a remotely fetched script directly into bash executes whatever the endpoint returns without a separate integrity-verification or review step; the PowerShell setup alternative has the same issue. HTTPS protects transport but does not prevent a compromised publisher or distribution endpoint from supplying malicious code capable of accessing local files and credentials.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI recovery path directs the agent to execute downloaded installation code without explaining its effects or requiring explicit installation approval. Although conditional and plausibly legitimate, this expands a read-oriented task into local code execution with the agent process's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Fiber AI homepage: https://fiber.ai
- API documentation: https://api.fiber.ai/