Security audit
Security checks for vulnerabilities and agentic risk
The Sorftime workflow is coherent, but automatic execution of downloaded setup code and undisclosed changes to other agent skills warrant review.
Review and install a specific CLI release yourself before use. Check its automatic agent-skill synchronization and disable it if unwanted. OOMOL handles the connected service credentials, and operations may consume credits. Confirm exact deletion targets. The remote installer and CLI implementation were not audited, limiting confidence in their side effects.
The supplied command performs remote installer execution, with no visible Sorftime MCP functionality or evidence that the installer supports it. This is materially different from the declared purpose. The downloaded script is not supplied, so its further actions cannot be determined.
The supplied chunk performs only a CLI login and shows no Sorftime MCP operations or integration. Authentication could be a supporting implementation detail if oo were established as a Sorftime client, but the supplied content provides no such connection.
The setup command downloads a mutable remote script and immediately executes it with the agent's local permissions, without integrity verification or review; the PowerShell alternative has the same issue. Compromise of the distribution endpoint could enable arbitrary code execution, credential theft, or local data modification, although the missing-CLI prerequisite limits when this path is reached.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources