Security audit
Security checks for vulnerabilities and agentic risk
The Phonely reading features fit their purpose, but automatic installation and undisclosed changes to agent skills warrant review.
Review and preinstall a verified CLI release before using this skill, and require approval for installation. Consider whether OOMOL should mediate access to your call transcripts. Upstream documents OO_SKILLS_SYNC_DISABLED as a control for automatic skill synchronization in its [command reference](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md). The remote installer payload could not be inspected; no malicious intent or exfiltration was established.
The supplied code performs remote script execution for an apparent CLI installation, not Phonely data search or retrieval. Nothing in the supplied chunk establishes that this installation supports Phonely access. The downloaded script's further behavior is not visible.
The supplied code performs only a login operation; it does not search or read Phonely data or identify Phonely as its target. Authentication could be a supporting implementation detail, but the supplied chunk provides no evidence of that connection and implements a different primary operation.
The command pipes a mutable remote script directly into Bash without checking a pinned version, signature, or trusted digest; the PowerShell alternative has the same execution pattern. HTTPS protects transport but does not prevent a compromised distribution endpoint from serving malicious code, making this a supply-chain risk rather than evidence of malicious author intent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The missing-command fallback directs the agent to install software by executing downloaded scripts without an explicit approval step or integrity verification. Although conditional on a setup failure, it expands a read-only data task into local code execution; a compromised installer could access files and credentials with the executing user's permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources