higgsfield-marketplace-cards
Fail
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to install the
higgsfieldCLI by piping a remote script directly into the shell usingcurl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. This pattern is highly susceptible to supply chain attacks or script modification at the source. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to executehiggsfield marketplace-cards createcommands. It builds these commands by interpolating user-provided inputs (such as--prompt,--brand_context, and--category) directly into the command string. Without explicit sanitization or parameterization, this allows for potential command injection if a user provides input containing shell metacharacters. - [EXTERNAL_DOWNLOADS]: The skill relies on fetching software and installers from
github.com/higgsfield-ai, which is an external third-party source relative to the skill author.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata