Security audit
Security checks for vulnerabilities and agentic risk
The DocSpace read operations fit the stated purpose, but missing software triggers immediate execution of an unverified remote installer.
Review the CLI setup before enabling this skill. Prefer a separately reviewed, version-pinned installation and require approval before any fallback installer runs. Consider OOMOL's access to your connected DocSpace account and use read-only credentials where available. Installer contents and exact system changes remain unverified; the artifacts do not establish data theft or malicious intent.
The supplied code performs no visible ONLYOFFICE DocSpace search or read operation. Instead, it executes an installer from an unrelated domain, with no demonstrated connection to the declared functionality. The downloaded script's contents and further effects cannot be determined from this chunk.
The command pipes a mutable remote script directly into Bash without version pinning or independent integrity verification; the Windows alternative uses the same fetch-and-execute pattern. A compromised distribution endpoint or altered installer could execute arbitrary code with the agent's account permissions, potentially exposing local files and credentials; HTTPS and the missing-CLI condition do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs an agent to install software after a command-not-found error without first obtaining approval for local system changes. Although conditional and plausibly legitimate, installation goes beyond the user's DocSpace read request and executes code with the invoking account's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- ONLYOFFICE DocSpace homepage: https://www.onlyoffice.com/docspace.aspx
- API documentation: https://api.onlyoffice.com/docspace/