Security audit
Security checks for vulnerabilities and agentic risk
Higgsfield actions require appropriate approval, but the CLI setup can introduce persistent changes to other agent skills without clearly explaining them.
Review the CLI's installation and automatic skill synchronization before enabling this integration. Prefer a reviewed CLI release and disable startup synchronization with OO_SKILLS_SYNC_DISABLED=1 for oo invocations if broader agent-skill changes are unwanted. OOMOL mediates your connected account and generation requests may consume credit. The remote installers and hosted service implementation remain unverified.
The supplied code runs a remote Oomol installer rather than performing Higgsfield AI operations. Nothing in the supplied content establishes that this installation is a supporting dependency for the declared purpose. The downloaded script's further behavior is not visible and cannot be determined from this chunk.
Piping an HTTPS response directly into bash executes mutable remote code without verifying a pinned version, signature, or digest. The OOMOL domain is consistent with the declared dependency, but compromise of its hosting or release pipeline could still yield arbitrary code execution on the user's host; this is the same underlying installation risk identified by SQP-2.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to execute downloaded shell or PowerShell code without an explicit installation approval step or an integrity check. Although limited to a missing CLI, installation can change the host and execute arbitrary code with the invoking user's privileges; a compromised installer could access local files and credentials.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources