Security audit
Security checks for vulnerabilities and agentic risk
The Together AI workflow fits its purpose, but setup executes unchecked remote code and leaves broader changes to agent applications unexplained.
Review the CLI installation separately before enabling automatic setup. Use a reviewed release, decide whether cross-application skill synchronization is acceptable, and limit submitted content and inference spending to your request. Upstream documents OO_SKILLS_SYNC_DISABLED=1 to prevent startup skill writes. The remote installer and hosted connector remain outside the inspected artifact; the evidence supports review rather than a malicious verdict. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md)
The supplied command does not visibly access Together AI or perform its declared data operations. Instead, it retrieves and executes an installer from cli.oomol.com, with no demonstrated connection to the declared purpose. The downloaded script is not supplied, so its further actions cannot be determined.
Authentication can be a supporting implementation detail, but the supplied chunk consists entirely of an oo login command and shows no Together AI integration or data operations. Its demonstrated primary behavior therefore differs materially from the declared purpose.
The fallback pipes a remotely fetched, unpinned script directly into a shell without an integrity check or review. Compromise of the distribution endpoint or installer could execute arbitrary code with the agent process's permissions; the Windows installation example has the same weakness, although setup runs only when the CLI is missing.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The untagged create_chat_completion action inherits the instruction that untagged actions are reads and safe to run directly, although generating completions consumes billable inference resources. This misclassification bypasses the skill's confirmation gate, potentially allowing unexpected charges, although an explicit user request for a completion reduces that risk.
The workflow instructs the agent to execute actions, and the safety section treats the untagged create_chat_completion action as a read that is safe to run directly. Chat completion requests transmit message content to Together AI through the connector, but the skill provides no warning about sending potentially sensitive user content; the write-confirmation safeguard does not cover this action.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources