higgsfield-game-generation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). One URL is high-risk: it points to a raw GitHub shell install script (curl ... | sh), a direct .sh download meant to be executed which can deliver arbitrary code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code during runtime — e.g. curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh (SKILL.md) and downloading/running Blender from https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz (references/3d-animation.md) — so these URLs enable execution of external code the skill relies on.