higgsfield
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious instructions, obfuscation, or unauthorized data access patterns were detected. The skill's architecture is tailored for professional video generation workflows.
- [EXTERNAL_DOWNLOADS]: The skill downloads media assets from Higgsfield's official CDN and candidate images from the web for visual reference. These downloads are limited to image and video formats and are integral to the generation process.
- [COMMAND_EXECUTION]: Deterministic engine scripts utilize ffmpeg, ffprobe, and jq to process media files locally. The orchestrator also uses git commands for version-controlling internal reference files, which is consistent with the skill's self-learning feature.
- [INDIRECT_PROMPT_INJECTION]: The skill research phase involves fetching content from external websites. This potential attack surface is addressed by strict subagent instructions that restrict prompt enrichment to physical visual descriptors, preventing narrative or behavioral overrides.
Audit Metadata