Security audit
Security checks for vulnerabilities and agentic risk
The Aircall features fit the stated purpose, but setup tells the agent to execute unverified online installers without a clear approval step.
Review and install the CLI separately using a verified release before allowing this skill to run. Review its automatic skill synchronization, and connect only the Aircall account you intend to expose through OOMOL. The remote installers could not be inspected, so their exact effects remain uncertain.
The supplied chunk performs remote installer execution rather than Aircall data access. Dependency installation can be a supporting implementation detail, but nothing supplied establishes this installer as an Aircall dependency. Its downstream behavior cannot be determined from this chunk.
Piping an HTTPS download directly into Bash executes mutable remote content without a pinned version or independent integrity verification. Compromise of the installer host or distribution pipeline could therefore lead to arbitrary code execution and access to locally accessible data and credentials. The expected vendor domain and legitimate setup purpose reduce suspicion of malicious intent, but do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill instructs the agent to execute remotely supplied installation code without a separate approval or verification step. This expands an Aircall data-reading request into local software installation, and a compromised installer could execute arbitrary commands with the invoking user's permissions. The fallback condition reduces exposure but does not establish authorization for installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources