Security audit
Security checks for vulnerabilities and agentic risk
The TalentLMS workflow includes sensible safeguards, but setup directs the agent to execute a downloaded installer without verification or clear user approval.
Review and approve CLI setup separately, including its installation and synchronization of other agent skills. Prefer a reviewed, version-pinned installation. OOMOL mediates access to your connected TalentLMS account; retain the required confirmations before changing or deleting records. The downloaded installer and hosted runtime were not verified.
The supplied chunk performs remote installer execution rather than TalentLMS data operations. Nothing in the chunk establishes that this installation is a supporting dependency for the declared purpose. The installer’s contents are not supplied, so its downstream behavior cannot be determined.
The command pipes a remotely fetched, unpinned script directly into Bash without integrity verification or an inspection step; the PowerShell alternative uses the same download-and-execute pattern. Compromise of the distribution endpoint could execute attacker-controlled code with the invoking user's privileges, although the legitimate dependency and conditional setup context provide no evidence of malicious author intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation of local software after a missing-command error without explicitly requiring user approval or explaining the installer's system changes. Restricting installation to first-time setup reduces exposure, but a request to operate TalentLMS does not necessarily authorize modifying the local execution environment.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources