Security audit
Security checks for vulnerabilities and agentic risk
The Telnyx workflow includes user approval for sending messages, but its setup fallback runs an unverified remote installer without a separate approval step.
Review the CLI installation before enabling this skill. Prefer a verified, pinned installation under your control, and check whether it installs or updates other agent skills. OOMOL handles the connected credentials and requests; approve that intermediary and confirm message recipients and content before sending. The bundled instructions were fully inspected, but the remote installer and hosted connector implementation remain unverified.
The visible behavior is remote installer execution, not interaction with Telnyx. Nothing in the supplied code establishes this installer as a supporting dependency for Telnyx operations. The downloaded script's contents are not provided, so its further behavior cannot be determined.
Piping an unpinned HTTPS download directly into bash executes whatever the installation endpoint serves with the agent process's privileges. Compromise of the distribution endpoint or installer supply chain could expose accessible credentials and files or modify the host; HTTPS alone does not establish installer integrity.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute remotely supplied shell or PowerShell code without first obtaining approval for local code execution and system changes. Although installation supports the legitimate Telnyx workflow and occurs only when the CLI is missing, that condition does not authorize arbitrary installer behavior on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources