Security audit
Security checks for vulnerabilities and agentic risk
The Clari Copilot features fit the stated purpose, but setup directs execution of unverified installation code without a clear approval step.
Review and approve CLI installation separately, preferably using a pinned, verified release. Check its automatic skill synchronization before running it in an existing agent environment. Be comfortable with OOMOL mediating access to private Clari call data and connection credentials. The bundled instructions were fully inspected, but the external installers, CLI binary, and live service behavior were not verified.
The declared purpose concerns accessing Clari Copilot data, but the supplied code executes an installer hosted on an unrelated domain. Nothing in the chunk establishes that this installation supports Clari Copilot functionality. The downloaded script is not supplied, so its specific effects cannot be determined.
Piping an unpinned remote script directly into Bash executes whatever the endpoint serves with the invoking user's privileges, without prior integrity verification or review. A compromised distribution endpoint could therefore execute arbitrary code or access local secrets; HTTPS and the legitimate dependency context do not eliminate that supply-chain risk. The PowerShell installation example has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
On a missing-command error, the setup instructions direct installation without first explaining the execution of remote code or obtaining approval for local system changes. This crosses beyond the expected read-only data workflow; the conditional trigger and declared Bash(oo *) restriction reduce exposure, but do not make the installation instructions safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources