higgsfield-marketplace-cards

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — the first is a raw GitHub install.sh (a direct shell script download intended to be run), which is high-risk when from an unverified/unknown repo, and the second is an incomplete/malformed URL, so together they represent a suspicious download source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's bootstrap directs executing a remote installer via curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh which runs fetched code during setup and is a required runtime dependency for the CLI.