Security audit
Security checks for vulnerabilities and agentic risk
The tl;dv operations are appropriately scoped, but setup can execute unverified remote software and introduce broader agent changes without clear user approval.
Review CLI installation separately and verify a fixed release before allowing execution. Check or disable its automatic skill synchronization before use. OOMOL will mediate access to your connected tl;dv account, so consider the sensitivity of meeting content and confirm imports. The installer and resulting binary were not verified; the artifact does not establish malicious intent.
The supplied code performs no visible tl;dv operation and instead executes an installer from a different service. Installation could be a supporting implementation detail if its relationship to tl;dv were established, but no such relationship appears in the supplied chunk. The remote script's contents and any further effects cannot be determined from this code alone.
Piping an HTTPS response directly into bash executes mutable remote content without a pinned version, integrity verification, or review; the PowerShell alternative has the same weakness. Compromise of the installer distribution path could yield arbitrary code execution and access to files or credentials available to the agent, although the file provides no evidence that the current installer is malicious.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback instructs the agent to execute remote shell or PowerShell scripts without first requesting installation approval or explaining the resulting local system changes. Although triggered only when the required CLI is missing, this expands a tl;dv data task into execution of unreviewed code with the agent process's privileges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources