media-higgsfield-identity
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: References the official Higgsfield AI skills repository on GitHub (github.com/higgsfield-ai/skills) for documentation and standards. This is a legitimate reference to the target service's public resources.
- [COMMAND_EXECUTION]: The skill instructs the agent to use specific tools such as
show_charactersandshow_reference_elements. These represent controlled tool invocations for the Higgsfield service rather than arbitrary shell commands. - [DATA_EXFILTRATION]: Outlines a process for uploading media to the Higgsfield service. This is the primary purpose of the skill and uses standard, non-obfuscated API sequences (upload, confirm) to handle user data within the vendor's ecosystem.
- [PROMPT_INJECTION]: The skill processes external data via ingestion points like the
medias[]andnameparameters inshow_reference_elements(SKILL.md). This surface is managed by boundary markers (the<<<id>>>syntax), server-side sanitization (auto-categorization), and constraints on input length, limiting the risk of indirect injection.
Audit Metadata