Security audit
Security checks for vulnerabilities and agentic risk
The Rootly workflow is appropriate, but its setup can execute unverified remote installers without a clear user approval step.
Review the setup before enabling this skill. Install a reviewed, version-pinned CLI yourself and require approval for software installation or changes to other agent skills. Use read-only Rootly access where available and understand that OOMOL mediates account access. The remote installer could not be retrieved for inspection.
The supplied command does not search or read Rootly data. It fetches and executes an Oomol installation script, with no demonstrated connection to Rootly functionality. This is a materially different operation involving an inconsistent resource, rather than an established supporting implementation detail. The downloaded script's further behavior cannot be determined from this chunk.
The command executes a mutable remote script immediately without signature verification, a pinned digest, or review; the PowerShell alternative has the same issue. Compromise of the distribution endpoint or installer could execute arbitrary code with the agent's local permissions, exposing files and credentials even though Rootly credentials are injected server-side. The legitimate dependency and conditional setup reduce suspicion of malicious intent but do not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software on the local system without first explaining the changes or obtaining explicit approval. A request to read Rootly data does not necessarily authorize local software installation, although the missing-command condition limits when this risk arises.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources