Security audit
Security checks for vulnerabilities and agentic risk
The Otter.ai reader has a coherent purpose, but its setup instructions can execute unverified remote installers without a clear user decision.
Review the setup behavior before installing. Prefer a separately reviewed, verified CLI installation and require approval before remote installer execution. Connecting Otter.ai lets OOMOL mediate access to private meeting data. Check the CLI's automatic bundled-skill installation behavior. No malicious behavior was established, but the remote installer and executable were not verified.
The supplied chunk performs remote installer execution and contains no Otter.ai search or read operation. No evidence establishes this installer as a necessary supporting dependency, so its behavior is not represented by the declared purpose. The downloaded script's contents and further effects are unknown.
The command executes a remotely supplied, mutable script with the agent process's permissions without independently verifying its integrity; the PowerShell alternative has the same weakness. If the distribution endpoint or publishing pipeline is compromised, this could expose locally accessible credentials and files or modify the environment, despite the legitimate dependency-installation context and HTTPS transport.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-command fallback directs the agent to install software without first explaining the local system changes or obtaining approval, expanding a data-reading task into code execution. Restricting installation to a missing CLI reduces exposure, but a user's request to read Otter.ai data does not itself authorize installing software.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources