Security audit
Security checks for vulnerabilities and agentic risk
The Supervisely reads fit the stated purpose, but setup can execute unverified remote code without a clear user approval step.
Review before installing. Install a verified, pinned CLI separately and require approval before setup changes. Review its automatic skill synchronization and disable it if unwanted, as described in the [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). Use a limited Supervisely connection and understand that OOMOL mediates credential use and requests. The bundle shows no malicious intent, but does not contain the installer or backend implementation.
The supplied command performs remote installer execution and contains no Supervisely search or read operation. Nothing supplied establishes this installer as a necessary supporting implementation detail for the declared purpose. The downloaded script's contents and any resulting system changes are not visible in this code chunk.
Piping an HTTPS download directly into Bash executes mutable remote code without verifying its integrity or reviewing it first. Compromise of the distribution endpoint or release pipeline could execute attacker-controlled code with the invoking user's privileges, potentially exposing local credentials and files; the installation context explains the command but does not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute downloaded shell or PowerShell code without first obtaining explicit approval for code execution and system changes. Although conditional dependency installation is legitimate, a missing CLI does not itself authorize executing a remote installer with the user's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- Supervisely homepage: https://supervisely.com
- API documentation: https://api.docs.supervisely.com/