higgsfield
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses browser automation tools (
mcp__claude-in-chrome__*) to navigate the Higgsfield AI website, input text prompts, and click buttons. This is the core intended functionality and is restricted to the target domain. - [DATA_EXFILTRATION]: The skill accesses local files via the
upload_imagetool, but only for the purpose of uploading them to the user's Higgsfield account for media processing as explicitly requested in the prompt. - [SAFE]: The skill adheres to security best practices by requiring the user to be manually logged into the target service (
higgsfield.ai) before proceeding, ensuring no credentials are handled or stored by the skill itself. - [SAFE]: JavaScript execution via
javascript_toolis used exclusively for DOM inspection to detect generation progress and extract result URLs from the webpage.
Audit Metadata