higgsfield-marketplace-cards
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute an installation script from the Higgsfield GitHub repository (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh). This is a standard bootstrap procedure for the tool.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute Higgsfield CLI commands. The agent is instructed to construct and run commands based on user intent, which is the primary functionality of the skill.
- [PROMPT_INJECTION]: The skill ingests user-provided text through the
--promptargument. 1. Ingestion points: User input captured in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Bash tool used to execute CLI commands. 4. Sanitization: Relies on backend enhancement logic as described in the skill documentation.
Audit Metadata