Security audit
Security checks for vulnerabilities and agentic risk
The calendar functions have clear approval controls, but setup directs the agent to execute an unverified remote installer without separate approval.
Review and approve the CLI installation separately, using a pinned release with independently verified integrity. Check its automatic skill synchronization before allowing it to modify agent configuration. OOMOL will mediate access to your connected calendar account. Calendar changes require confirmation, but the remote installers and hosted implementation remain unverified; no malicious payload was established.
The supplied code performs remote software installation rather than any Cal.com operation. Although dependency installation can be a supporting implementation detail, this chunk provides no evidence connecting the Oomol installer to the declared Cal.com functionality. The downloaded script's contents and further effects are not available for assessment.
The setup instructions pipe a remotely fetched, unpinned script directly into Bash without independent integrity verification; the PowerShell alternative uses the same download-and-execute pattern. If the distribution endpoint or release pipeline is compromised, attacker-controlled code executes with the agent process's permissions and could access local files or credentials. The missing-CLI condition limits exposure, but HTTPS and server-side Cal.com credential handling do not eliminate this local execution risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources