Security audit
Security checks for vulnerabilities and agentic risk
The KrispCall integration is coherent, but its setup fallback executes downloaded code without verification or explicit installation approval.
Review setup before installing. Install and verify the required CLI separately, and approve any additional agent skills it installs or updates. OOMOL will mediate access to your connected KrispCall account. Retain the skill's confirmation requirements for changes and deletions. The remote installers were unavailable for inspection, so their full local effects remain uncertain.
The supplied command installs software from Oomol rather than interacting with KrispCall. Nothing in the supplied chunk establishes this installation as a supporting dependency for the declared purpose. The remote script's contents are unavailable, so its further effects cannot be determined.
The command pipes a remotely retrieved, mutable script directly into Bash without integrity verification or an opportunity to inspect it; the PowerShell alternative has the same issue. A compromised distribution endpoint could execute arbitrary code with the invoking user's privileges, exposing local files and credentials even though KrispCall tokens are injected server-side.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to install software after a missing-command error without first obtaining approval for local system changes. Although conditional and relevant to the integration, this expands a KrispCall data request into local code execution and installation; the declared tool restriction may limit execution but does not make the instruction safe.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources