higgsfield-soul-id
Fail
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The bootstrap instructions direct the agent to install the Higgsfield CLI by downloading a script from a GitHub repository and piping it directly to the shell (
curl -fsSL ... | sh). Although the source is the official repository for the Higgsfield AI service, this installation method is inherently risky as it executes remote code without prior verification. - [EXTERNAL_DOWNLOADS]: The skill downloads installation scripts and interacts with resources from the
higgsfield-aiGitHub organization. These resources belong to the primary service provider for the functionality the skill offers. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform operations such as authentication, polling, and model training via thehiggsfieldCLI. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted user-provided strings, like character names, directly into shell command arguments without explicit sanitization or validation logic.
- Ingestion points: User-provided name and image path arguments defined in
SKILL.md. - Boundary markers: The skill uses double quotes (
--name "<name>") as a delimiter, which can be bypassed by shell metacharacters. - Capability inventory: Subprocess execution via the
Bashtool. - Sanitization: No evidence of input validation or escaping is present in the instructions.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh - DO NOT USE without thorough review
Audit Metadata