higgsfield-marketplace-cards

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The instruction to curl and pipe a remote install script from raw.githubusercontent.com (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) is high-risk because executing third-party shell scripts fetched over the network (especially from an unvetted GitHub repo) can deliver malware or run arbitrary commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bootstrap instruction runs a remote shell script with curl | sh, downloading and executing https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh to install the required 'higgsfield' CLI, so it is a runtime external dependency that executes remote code.