Security audit
Security checks for vulnerabilities and agentic risk
The Dialpad read functions fit the stated purpose, but setup can execute unverified remote code without clear approval or disclosure of broader agent changes.
Review the CLI installation before enabling this skill, approve host changes explicitly, and decide whether automatic installation of other agent skills is acceptable. Your Dialpad connection and workforce data are handled through OOMOL. The remote installer and backend were not fully verified; no malicious behavior was established.
The supplied code performs remote software installation rather than searching or reading Dialpad WFM data. No Dialpad interaction or evidence connecting this installer to the declared functionality is shown. The remote script's contents and further effects are not available for assessment.
The command pipes a mutable remote script directly into Bash without verifying its integrity or inspecting it; the adjacent PowerShell example has the same issue. Although the OOMOL domain is contextually appropriate for this connector, compromise of its distribution infrastructure could cause arbitrary code execution with the invoking user's privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A request to read WFM data can trigger instructions to install software and execute remote code without separate user approval or an explanation of local system changes. The missing-command condition limits exposure, but does not establish authorization to modify the host; actual execution also depends on the agent's tool permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources