Security audit
Security checks for vulnerabilities and agentic risk
The IT Glue workflow is coherent, but its setup fallback runs downloaded code without clear approval or limits on lasting local changes.
Review the setup behavior before enabling this skill. Prefer a separately approved, reviewed CLI installation and retain control over additional agent-skill changes. Only connect IT Glue if you trust OOMOL to handle the connection and returned records. The bundled instructions were fully inspected, but the remote installers and connector implementation remain unverified; no malicious behavior was established.
The supplied command runs an Oomol installer and shows no IT Glue access or data retrieval. Nothing in the supplied content establishes this installation as a supporting dependency for the declared purpose. The downloaded script's further behavior cannot be determined from this code chunk.
Piping a remote installation script directly into Bash executes mutable network-supplied code without version pinning or independent integrity verification; the PowerShell alternative has the same weakness. HTTPS and the provider's legitimate role reduce some risks but do not protect against a compromised distribution endpoint or malicious installer update, which could access local data with the agent's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-CLI fallback directs the agent to execute downloaded installation code without first obtaining approval for local software installation. Although conditional and relevant to setup, it expands a read-oriented IT Glue request into local code execution and system changes with the agent's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- IT Glue homepage: https://www.itglue.com/
- API documentation: https://api.itglue.com/developer/