Security audit
Security checks for vulnerabilities and agentic risk
The Stormboard read actions fit the purpose, but setup can execute unverified remote software without a user approval step.
Review and approve the oo installation separately before using this skill. Its installer was not verified, and the dependency may install additional agent skills. Review its startup synchronization controls and ensure you accept OOMOL handling your Stormboard connection and requests.
The supplied command installs software by piping a remotely fetched script into Bash; it does not search or read Stormboard data. No evidence in the chunk establishes this installation as a supporting dependency for the declared Stormboard functionality. The downloaded script's additional behavior cannot be determined from the supplied code.
Piping a downloaded script directly into Bash executes mutable remote content with the invoking user's privileges, without an integrity check or review step. Compromise of the installation endpoint or its delivery infrastructure could therefore lead to local code execution; the PowerShell equivalent has the same risk, despite the legitimate setup purpose.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to install software by executing a remote script without first obtaining approval for local code execution and system changes. Restricting this to first-time setup reduces exposure, but a request to read Stormboard data does not itself authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Stormboard homepage: https://stormboard.com
- API documentation: https://api.stormboard.com/docs