Security audit
Security checks for vulnerabilities and agentic risk
The Granola features fit their purpose, but a read-only request can trigger an unverified software installer without a separate approval step.
Review and explicitly approve CLI setup before allowing the agent to install it. Use a reviewed, fixed release and consider disabling automatic skill synchronization before invoking oo. Connect only the intended Granola account and consider OOMOL's access to meeting content. The bundled skill was fully inspected, but downloaded installer contents and backend behavior remain unverified; no malicious intent was established.
The supplied code performs remote software installation rather than searching or reading Granola data. Nothing in the chunk establishes that the Oomol installer is a supporting dependency for Granola functionality. The downloaded script's contents and further effects cannot be determined from this chunk.
The command pipes a remotely fetched, unpinned script directly into Bash without checking its integrity or reviewing it; the PowerShell alternative uses the same download-and-execute pattern. If the distribution endpoint or release infrastructure is compromised, attacker-controlled code could execute with the agent process's permissions and access local files or credentials. HTTPS and conditional first-time setup reduce some exposure but do not verify the script's contents.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the workflow directs installation without explaining that this executes third-party code and may modify the local environment, or requiring explicit approval. The missing-command condition limits exposure, but a read-only Granola request could still lead to unexpected software installation under the executing user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources