Security audit
Security checks for vulnerabilities and agentic risk
The AssemblyAI actions have clear safeguards, but fallback setup executes unverified remote code without a separate approval step.
Review and approve CLI installation separately before letting an agent perform setup. Check the installer's integrity and the CLI's bundled-skill behavior. OOMOL will mediate access to your connected AssemblyAI account; creation and deletion remain subject to explicit confirmation. The complete bundled artifact was inspected, but remote installer contents and external credential handling remain unverified.
The supplied code performs remote script execution for an Oomol CLI installer. It contains no AssemblyAI interaction or evidence establishing this installation as a supporting dependency for AssemblyAI tasks. The remote script's contents are not supplied, so its subsequent behavior cannot be assessed.
The curl-to-bash command executes mutable remote content immediately, without a pinned version, signature check, or opportunity to review the downloaded script. Compromise of the vendor's distribution infrastructure could therefore compromise the local account; this is the same underlying installation risk identified by SQP-2, not a separate attack chain.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback setup directs execution of remotely downloaded shell and PowerShell scripts without integrity verification or explicit approval for local installation. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges; the missing-CLI condition limits exposure but does not make execution safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources