content-engine

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs are legitimate service pages (Topaz, Runway, Hugging Face, Google fonts, Artlist, etc.), but the list also includes a raw GitHub install script (raw.githubusercontent.com/.../install.sh) that is intended to be piped to sh, multiple GitHub repos from small/individual accounts (potentially unvetted release code), localhost/placeholders (e.g. http://localhost:8188/* and https://your-start-frame.png) and browser-session endpoints used for automation — together these elements raise a moderate-to-high risk for untrusted executable distribution and warrant caution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes an explicit runtime install command that fetches and executes a remote shell script for the Higgsfield CLI (curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh), which is invoked as a required/recommended runtime dependency for generation — this is a high-confidence remote fetch-and-execute risk.