Security audit
Security checks for vulnerabilities and agentic risk
The Sling reads fit the stated purpose, but setup runs downloaded code without separate approval and omits broader changes the CLI can make to installed agent skills.
Review and approve CLI installation separately, preferably using a verified, fixed release. Before running it, consider disabling automatic agent-skill synchronization with OO_SKILLS_SYNC_DISABLED=1, as documented in the upstream command reference. Connect only the intended Sling account and accept OOMOL's role in processing requests. The remote installer payload remains unverified; this review found no evidence of malicious intent.
The supplied chunk performs remote installer execution, not Sling searching or reading. It shows no Sling integration or evidence that this installer is a necessary supporting implementation detail. The downloaded script's contents and any further effects are not available for assessment.
The command pipes a remotely fetched, unpinned script directly into Bash, allowing its contents to execute with the invoking user's privileges without prior inspection or integrity verification. HTTPS and the legitimate dependency context reduce suspicion of malicious intent but do not prevent a compromised distribution endpoint from delivering arbitrary code; the PowerShell alternative has the same underlying risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI triggers instructions to install software without first explaining local changes or obtaining approval. Although this fallback is conditional, authorization to read Sling data does not necessarily authorize installing and executing software on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Sling homepage: https://getsling.com
- API documentation: https://api.getsling.com/