Security audit
Security checks for vulnerabilities and agentic risk
The MeetGeek reader fits its stated purpose, but its fallback setup directs the agent to execute unverified remote installers without clear user control.
Review is warranted for the setup behavior, not the MeetGeek read actions. Install a reviewed, version-pinned CLI yourself and check its changes to other agent skills before connecting an account. OOMOL is a disclosed intermediary for sensitive meeting data. No malicious intent was established, but the remote installers and exact installed CLI behavior could not be audited.
The supplied chunk performs remote installer execution, not MeetGeek data access. Nothing in the supplied code establishes that this installation is a supporting dependency for the declared purpose. The downloaded script's contents and any additional effects are not available for assessment.
The command downloads a mutable remote script and immediately executes it without checking a pinned version, independently trusted digest, or signature. Compromise of the installation endpoint or distribution pipeline could therefore execute attacker-controlled code with the agent's local privileges; the legitimate dependency and HTTPS URL do not eliminate this supply-chain risk.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
When the CLI is missing, the skill directs the agent to install software without first obtaining approval for local system changes. Although conditional setup limits exposure, a request to read MeetGeek data does not inherently authorize running an installer with the agent's local permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources