higgsfield-marketplace-cards
Fail
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions include a bootstrap step that downloads and executes a shell script directly from a remote URL (
https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) using thecurl | shpattern. This method of installation is inherently dangerous as it executes unverified code from the internet. - [COMMAND_EXECUTION]: The skill directs the agent to build and run shell commands (
higgsfield marketplace-cards create) that include user-provided prompts and file paths. Constructing shell commands via string interpolation of untrusted user input without explicit sanitization steps can lead to command injection vulnerabilities.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata