higgsfield-game-generation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL is a raw GitHub install script that the skill instructs users to pipe to sh (curl … | sh), which is a high-risk pattern for distributing malware if the repository or account is untrusted or compromised.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code during runtime — e.g. curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh (SKILL.md) and downloading/running Blender from https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz (references/3d-animation.md) — so these URLs enable execution of external code the skill relies on.