Skills
Navigate
skills/kaveone/higgsfield-skills/higgsfield-websites/Gen Agent Trust Hub

higgsfield-websites

Fail

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The SKILL.md file instructs users to install a prerequisite CLI tool using the command curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. Executing unverified remote code from an untrusted repository directly in the shell is a high-risk security pattern.
  • [COMMAND_EXECUTION]: The skill facilitates the creation and execution of multiple local scripts, including compose_cover.py for image compositing and scroll-scrub-video.sh for video processing with ffmpeg. It also heavily relies on executing various higgsfield CLI commands through the Bash tool.
  • [EXTERNAL_DOWNLOADS]: The generated code within the skill performs network operations to fetch external resources. Specifically, the compose_cover.py script uses urllib.request to download fonts and logo assets from https://static.higgsfield.ai.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 8, 2026, 05:31 AM