Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because setup can execute unverified remote installers, and the safety rules incorrectly classify an audio-upload action as read-only.
Install the CLI separately using a reviewed, integrity-verified method rather than letting a failed reading request trigger installation. Before using read_text, explicitly authorize the text and its upload, especially for private material, and check the provider's storage controls. The review concerns follow directly from the skill's instructions; no malicious payload was established, and the external installer contents remain unverified.
The supplied command executes an external installer rather than searching or reading ElevenReader data. No connection between this installer and the declared ElevenReader functionality is established in the supplied code. The downloaded script's contents are not provided, so its further actions cannot be determined.
Piping an HTTPS response directly into bash executes mutable remote code without checking a pinned version, signature, or independently trusted digest. If the installer distribution is compromised, the script could access files and credentials or modify the environment with the invoking process's privileges. The OOMOL domain is relevant to the documented dependency, but relevance and HTTPS do not establish script integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The untagged read_text action generates speech and uploads the resulting audio to connector transit storage, despite the blanket claim that untagged actions are read-only and safe to run directly. This can bypass the skill's confirmation rule for state-changing operations and create an externally stored spoken copy of potentially sensitive text. Speech generation fits the skill's purpose, but that does not make the upload read-only or establish informed authorization.
The missing-CLI fallback directs the agent to execute downloaded installer code without a separate approval gate or warning about local system changes. A routine dependency error can therefore expand a reading task into local software installation with the agent's execution privileges. This overlaps with SC2 rather than representing an independent exploit path.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources