higgsfield-product-photoshoot

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The raw GitHub URL references an install.sh intended to be fetched and executed (curl ... | sh), which is a high-risk pattern for distributing malware; the cdn.higgsfield.ai links are just image files and not themselves executable.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow only ingests the user’s interview answers (mode/intent/prompt text) from the higgsfield product-photoshoot create --prompt ... argument into the backend enhancer to submit to gpt_image_2, and does not read any outsider-authored feed/inbox/ticket/issue text without first selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bootstrap step installs the CLI by piping a remote script to the shell ("curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh"), which fetches and executes remote code at runtime, making this URL a high-risk external dependency.