Security audit
Security checks for vulnerabilities and agentic risk
The GoDial workflow is controlled, but its CLI dependency can install additional agent skills without this skill clearly disclosing that effect.
Review and install a fixed CLI release before enabling this skill. Its documented startup skill synchronization extends beyond GoDial; consider disabling it with OO_SKILLS_SYNC_DISABLED=1 before invoking oo. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables) Confirm the connected GoDial account and each write payload. The external installer and hosted connector implementation were not verified.
The supplied command installs software from an Oomol endpoint rather than performing GoDial operations. Nothing in the supplied chunk establishes this installer as a supporting dependency for GoDial. The downloaded script's contents and further effects are not visible.
The supplied code only performs a CLI login rather than implementing the declared GoDial functionality. Authentication could be a supporting implementation detail if oo were established as part of the GoDial integration, but the supplied content provides no such connection.
The setup instructions pipe a remotely fetched, unpinned script directly into a shell, allowing whatever content the installer endpoint returns to execute with the invoking user's privileges. Compromise of the distribution endpoint could expose local files and credentials or modify the environment; the missing-CLI condition limits exposure but does not ensure integrity, and the PowerShell alternative has the same weakness.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources