higgsfield-game-generation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most links are to legitimate APIs, trusted vendor downloads, or GitHub repositories, but the raw GitHub URL points to a shell install script referenced with curl | sh in SKILL.md, which is a high-risk pattern (remote script piped to sh) and could be used to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote installation code via curl|sh (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) and downloading a Blender binary then running it (https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz), both of which are runtime steps that execute external code/binaries required by the skill.