Security audit
Security checks for vulnerabilities and agentic risk
The PRTG read workflow fits its purpose, but fallback setup executes unverified remote code without a clear approval step.
Review setup before installing. Install a reviewed, verified CLI release yourself and require approval for further installation or agent-skill changes. Use a read-only PRTG connection and consider OOMOL's access to monitoring data. The bundled instructions were fully inspected; the external installer and connector implementations remain unverified. No malicious behavior was established.
The supplied command performs an external installer operation rather than searching or reading PRTG Classic data. Nothing in the chunk establishes that this installer supports the declared functionality. The downloaded script's contents are not provided, so its additional effects cannot be assessed.
Piping a mutable remote script directly into bash executes its contents without an independent integrity check or review; the PowerShell alternative has the same weakness. HTTPS and the relevant vendor domain reduce some interception risk, but a compromised distribution endpoint could still supply code that accesses local files or credentials with the user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback tells the agent to install software by executing downloaded scripts without first explaining the system changes or obtaining explicit installation approval. Although conditional and relevant to the task, this crosses from reading PRTG data into local code execution with the invoking user's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources