Security audit
Security checks for vulnerabilities and agentic risk
The Seedance workflow requires approval for changes, but its setup can execute unchecked downloaded code and introduce broader agent-environment changes.
Review and approve the CLI installation separately, including whether it may install or synchronize additional agent skills. OOMOL mediates your Seedance requests, so consider the data and account access you grant it. The downloaded installers and hosted connector implementation were unavailable for inspection; their complete behavior remains unverified.
The supplied code performs remote script execution for an Oomol installer rather than the declared Seedance data operations. Dependency installation can be a supporting implementation detail, but the supplied material establishes no relationship between this installer and Seedance. The downloaded script's contents are unavailable, so its further effects cannot be determined.
Piping a live HTTPS response directly into bash executes mutable remote code without reviewing or authenticating the installer artifact. A compromised vendor endpoint or distribution pipeline could run arbitrary commands with the invoking user's privileges; the legitimate CLI dependency and conditional fallback reduce exposure but do not remove this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation through downloaded shell or PowerShell code without explicit user approval for host changes or any integrity verification. Although it is limited to a missing prerequisite and uses the documented vendor domain, executing an installer can alter the host with the invoking user's privileges; this overlaps with SC2 rather than constituting a separate exploit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources