Security audit
Security checks for vulnerabilities and agentic risk
The JustCall controls are appropriate, but setup can execute an unverified online installer without explicit approval.
Review and install a verified CLI version yourself before enabling automatic setup, including any bundled skills it installs. JustCall requests pass through OOMOL, which the skill says manages provider credentials server-side. Keep approval requirements for contact changes, deletions, and suppression-list changes. This review found a setup-control concern, not evidence of malicious intent.
The supplied chunk performs no visible JustCall operation; its sole action is downloading and executing an external installer. Although installing a required CLI could be a supporting implementation detail, nothing supplied establishes that this installer supports JustCall. The remote script's contents and any further effects cannot be determined from this chunk.
Piping a live HTTPS response directly into Bash executes whatever the installation endpoint supplies with the invoking user's privileges, without version pinning or independent integrity verification. A compromised distribution endpoint could execute arbitrary code and access local data; the PowerShell alternative has the same underlying risk, although there is no evidence that either endpoint is currently malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs installation through remotely supplied shell or PowerShell code without requiring explicit approval for local code execution and system changes. A missing CLI can therefore turn a JustCall task into an unreviewed software installation; the conditional trigger reduces exposure but does not establish user consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources