higgsfield-video-prompt

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data (shot intents and storyboards) which are then used to construct prompts for a video generation CLI.
  • Ingestion points: The workflow in SKILL.md requires taking a 'one-line shot intent from the storyboard' as a primary input.
  • Boundary markers: The instructions provide a 'Fill-in template' to structure the output, but there are no explicit instructions to the agent to sanitize or ignore potentially malicious instructions embedded within the intent strings.
  • Capability inventory: The skill performs shell command execution through the higgsfield CLI tool, which is a high-privilege capability in the context of user-controlled inputs.
  • Sanitization: There is no evidence of input validation or escaping for the shot intent before it is interpolated into the CLI prompt string.
  • [COMMAND_EXECUTION]: The skill relies on and provides detailed documentation for executing shell commands to interact with the Higgsfield API.
  • Evidence: The 'Running the gen on Higgsfield' section details specific command patterns such as higgsfield generate create seedance_2_0 --prompt "...".
  • Context: These commands are documented as the standard procedure for the skill's functionality and involve local tool execution and network communication with the service provider.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:04 AM
Security Audit — agent-trust-hub — higgsfield-video-prompt