Security audit
Security checks for vulnerabilities and agentic risk
The LightSpeed VT functions are appropriately scoped, but setup can run unverified remote installers without clear approval or limits on local changes.
Review the setup path before enabling this skill. Prefer an independently installed, integrity-verified CLI, and check whether it installs or updates other agent skills. Connect only the intended LightSpeed VT account and consider OOMOL's role in handling requests and credentials. The complete bundled artifact was inspected, but remote installer and connector behavior remain unverified.
The declared purpose concerns accessing LightSpeed VT data, but the supplied command executes an Oomol-hosted installer. No connection to LightSpeed VT functionality is established, so this cannot be treated as a demonstrated supporting implementation detail. The downloaded script's contents and further effects are not available for assessment.
The command pipes a mutable HTTPS response directly into Bash without pinning a release or verifying its integrity. HTTPS protects transport but not against compromise of the distribution source, so the installer could execute arbitrary commands and access files or credentials available to the process; its conditional setup role reduces exposure but does not remove the risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs an agent to execute downloaded shell or PowerShell code without requiring user approval, integrity verification, or an explanation of host changes. A missing CLI during an otherwise read-only task can therefore trigger host-level installation; a compromised installation source could execute arbitrary code with the invoking user's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources