Security audit
Security checks for vulnerabilities and agentic risk
The Emelia integration is coherent, but its setup instructions execute unverified remote code without a clear approval step.
Review and approve CLI installation separately, preferably using a verified release rather than executing a live download. Trust OOMOL to handle the connected Emelia account and its data. Publisher documentation describes automatic agent-skill synchronization; review that behavior and its OO_SKILLS_SYNC_DISABLED control in the [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). The remote installers were not verified.
The supplied command executes an external installation script and contains no Emelia search or read functionality. Nothing in the supplied code establishes this installation as a supporting dependency for Emelia, so its behavior materially differs from the declared purpose. The downloaded script's contents and further effects are not available for assessment.
The command pipes a live remote script directly into Bash without pinning or independently verifying its contents; the PowerShell alternative uses the same download-and-execute pattern. If the distribution endpoint or delivery pipeline is compromised, attacker-controlled code could execute with the agent process's permissions and access local files or credentials. The documented vendor relationship and missing-CLI-only trigger make this understandable setup behavior, but do not remove the supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without requiring approval for local system changes. An Emelia read request does not itself authorize software installation; the conditional trigger and declared Bash(oo *) tool restriction reduce exposure but do not make installation consent explicit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources