Security audit
Security checks for vulnerabilities and agentic risk
The NiftyImages features fit their purpose, but automatic installation runs unverified downloaded code and may add other skills to your agent.
Review dependency setup before installing. Prefer inspecting and installing a fixed CLI version yourself, and disable automatic skill synchronization if you want only this integration. Connecting NiftyImages authorizes OOMOL to mediate account access. The remote installers could not be inspected, and the hosted connector implementation was not supplied; this review does not establish their complete behavior.
The supplied command performs a remote installer execution rather than searching or reading NiftyImages data. Nothing in the chunk establishes that installing the Oomol CLI is a supporting implementation detail for the declared purpose. The downloaded script's additional behavior cannot be determined from this snippet.
Authentication could support a NiftyImages workflow, but the supplied chunk consists entirely of a login command and establishes no connection to NiftyImages. Its demonstrated primary behavior therefore differs from the declared search-and-read purpose.
Piping the HTTPS response directly into Bash executes whatever code the installer endpoint returns, without a pinned version or independently verified integrity. A compromised distribution endpoint could therefore execute arbitrary commands with the agent's local permissions; the PowerShell equivalent has the same weakness, although both paths are conditional on the CLI being absent.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
A missing CLI causes the instructions to escalate a read-oriented task into executing a remote installer and modifying the local environment without explicit approval. Although conditional dependency setup is legitimate, the lack of a clear warning and consent checkpoint leaves the user unaware of the expanded execution scope; this overlaps with SC2.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.
- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.
## Resources
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Resources
- NiftyImages homepage: https://niftyimages.com/
- API documentation: https://api.niftyimages.com/