Security audit
Security checks for vulnerabilities and agentic risk
The Northflank read operations fit the stated purpose, but setup directs the agent to run downloaded installation code without separate approval or verification.
Review setup before enabling this skill. Install an independently verified CLI release with explicit approval, check its bundled-skill synchronization settings, and connect Northflank with read-only permissions where available. OOMOL mediates account access. The remote installers were unavailable for inspection, so their complete local changes remain unknown.
The supplied command performs remote installer execution, an undeclared capability materially different from Northflank data access. Nothing in the chunk establishes that the Oomol installer is a supporting dependency for Northflank. The downloaded script's contents and further effects are not available for assessment.
The command pipes a mutable HTTPS response directly into Bash without pinning or independently verifying its contents. Compromise of the installer distribution path could execute arbitrary code with the invoking user's privileges, exposing local files and credentials; the PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs the agent to execute downloaded shell or PowerShell scripts without first obtaining explicit approval for installing software or explaining the system changes. A read-oriented Northflank request could therefore trigger local code execution if the CLI is missing; conditional execution reduces exposure but does not provide informed authorization.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources