higgsfield-brandkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow imports website metadata via an optional CLI command (higgsfield marketing-studio brand-kits fetch --url <url>), which fetches external web pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). An operational dependency is evidenced by the GitHub raw URL used to fetch and install the Higgsfield CLI shell script during setup (SKILL.md line 28, prerequisites.md line 65). The URL lacks cryptographic integrity enforcement or official foundation provenance beyond GitHub hosting, making it a weak/unknown runtime external dependency.