Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because setup runs unverified downloaded code and the safety rules incorrectly treat code execution as read-only.
Before installing, review and verify the CLI installer and control its automatic skill synchronization. Require approval of the exact code and expected effects before using the code-execution action. OOMOL mediates access to your connected Vapi account. The bundled instructions were fully inspected, but installer contents and remote sandbox behavior remain unverified; no malicious intent was established.
The supplied command performs remote installer execution rather than Vapi data operations. Nothing in the supplied chunk establishes that the Oomol installer is a supporting dependency for Vapi, so this is an undeclared capability involving an inconsistent resource. The downloaded script's further behavior cannot be determined from the supplied code.
The supplied chunk performs only a CLI login rather than the declared Vapi functionality. Authentication could be a supporting implementation detail if oo were established as a Vapi integration, but the supplied content provides no such connection. This assessment is limited to the shown chunk.
Piping the HTTPS download directly into bash executes mutable remote content without verifying a fixed, trusted artifact. HTTPS protects transport but not against compromise of the publisher or distribution infrastructure; this is the same underlying installation risk identified by SQP-2, not an independent attack path.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The untagged test_code_tool_execution action executes TypeScript, contradicting the blanket assertion that untagged actions are read-only and safe to run directly. This classification can cause an agent to bypass confirmation for code execution; the stated Vapi sandbox limits the demonstrated scope, but execution costs and any sandbox-permitted side effects remain possible.
The fallback directs the agent to execute remotely downloaded shell or PowerShell code without an explicit installation approval or artifact-verification step. Although this occurs only when the CLI is missing and serves a legitimate dependency need, a compromised installation source could execute arbitrary code with the agent's local permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources