Security audit
Security checks for vulnerabilities and agentic risk
The Snipe-IT read operations fit the stated purpose, but the required CLI can persistently change other agents’ installed skills without this guide explaining that effect.
Before using this skill, install a verified CLI release separately and use a read-only Snipe-IT API key. To prevent automatic changes to agent skill directories, set OO_SKILLS_SYNC_DISABLED=1 for every CLI invocation, as described in the [upstream reference](https://raw.githubusercontent.com/oomol-lab/oo-cli/main/docs/commands.md). Ensure you accept OOMOL handling your connected account’s requests and records. The remote installers were unavailable for inspection.
The supplied command performs remote script execution rather than searching or reading Snipe-IT data. Nothing in the chunk establishes that this installation is a supporting dependency for the declared purpose. The downloaded script's contents and resulting system changes cannot be determined from this chunk.
The setup instructions pipe a mutable remote script directly into Bash without pinning or verifying its contents; the PowerShell alternative uses the same download-and-execute pattern. If the distribution endpoint or release infrastructure is compromised, attacker-controlled code could run with the agent process's permissions and access local files or credentials. The legitimate dependency and missing-command condition reduce exposure frequency but do not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources