Security audit
Security checks for vulnerabilities and agentic risk
The Perplexity workflow is coherent, but setup directs the agent to execute an unverified remote installer without clear user approval.
Review and approve the CLI installation separately, including its automatic installation of other agent skills. Prefer a fixed, verified release over executing the supplied remote-script commands directly. Requests pass through OOMOL and may incur charges. The installer and live connector implementation were not verified; no malicious payload was established.
The supplied command performs remote software installation, not a demonstrated Perplexity operation. Although installation can be a supporting implementation detail, the supplied content establishes no relationship between this installer and the declared Perplexity capabilities. The downloaded script's contents and subsequent effects are not available for assessment.
Piping a mutable remote response directly into Bash gives the downloaded content immediate execution privileges without an opportunity to verify it first. HTTPS protects transport but does not prevent malicious changes at the publisher or distribution infrastructure; this is the same underlying installation risk identified in SQP-2, not a separate exploit.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The setup instructions direct the agent to execute downloaded shell or PowerShell scripts immediately, without integrity verification, review, or explicit installation approval. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges; limiting setup to a missing-CLI error reduces exposure but does not protect the execution path.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources