Security audit
Security checks for vulnerabilities and agentic risk
The lighting controls are appropriately scoped, but setup can execute unchecked downloaded code and introduce broader agent changes without clear user approval.
Review setup before enabling this skill. Explicitly approve a verified CLI installation and review or disable its bundled-skill synchronization. OOMOL will broker your LIFX account access. The remote installers and hosted connector implementation were not inspected; no malicious behavior was established in the bundled artifact.
The supplied code performs remote script execution but contains no LIFX operations or evidence that this installation supports LIFX functionality. Its visible behavior therefore materially differs from the declared purpose. The downloaded script's contents and subsequent effects cannot be determined from this chunk.
The command immediately executes a mutable remote script without checking its integrity or reviewing its contents; the PowerShell alternative uses the same unsafe pattern. If the distribution endpoint or publishing pipeline is compromised, attacker-controlled code could execute with the invoking user's privileges, although the missing-CLI condition limits exposure.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The fallback directs the agent to install software when the CLI is missing without requiring approval or explaining potential host-system changes. Although conditional and relevant to setup, this expands a LIFX task into host modification without a clear authorization boundary.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- LIFX homepage: https://www.lifx.com
- API documentation: https://api.developer.lifx.com/reference/authentication