Security audit
Security checks for vulnerabilities and agentic risk
The Leonardo.Ai workflow is coherent, but its automatic setup can execute unverified installers and introduce undisclosed changes to other agent skills.
Review and approve CLI installation separately before use; the remote installer contents could not be verified here. Consider disabling automatic agent-skill synchronization using the documented OO_SKILLS_SYNC_DISABLED setting before running oo. Understand that OOMOL mediates account access and requests, and confirm generation parameters and any associated cost. No malicious intent was established. [CLI controls](https://github.com/oomol-lab/oo-cli/blob/main/docs/commands.md#environment-variables)
The supplied code installs software from an Oomol endpoint rather than performing any visible Leonardo.Ai operation. Although dependency installation can be a supporting implementation detail, the supplied chunk establishes no relationship between this installer and the declared functionality. The remote script's contents and any further effects cannot be determined from this code.
The curl-to-bash pipeline executes mutable remote content without checking a pinned version, signature, or trusted digest; the PowerShell alternative has the same underlying problem. Compromise of the distribution endpoint or installer could yield arbitrary code execution with the invoking user's privileges, potentially exposing local files and credentials, though the skill provides no evidence of a malicious installer.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software by executing downloaded scripts without first disclosing the system changes or obtaining installation-specific approval. Although installation is a legitimate prerequisite and occurs only when the CLI is missing, a Leonardo.Ai task does not inherently authorize running third-party installation code on the user's machine.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources