higgsfield-ugc-prompt
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a structured prompt engineering tool that transforms user input about products into detailed video scripts. It does not perform any file system operations, network requests, or code execution.
- [DATA_EXPOSURE]: There are no hardcoded credentials or attempts to access sensitive local files like SSH keys or environment variables.
- [REMOTE_CODE_EXECUTION]: The skill contains no commands to install packages or execute remote scripts. It is purely instructional.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (product descriptions and reference images). This creates a surface for indirect prompt injection where an attacker might try to embed instructions in product descriptions. However, the skill provides a rigid template and specific rules that constrain the output, and it lacks dangerous capabilities (like shell access) that would make such an injection high-risk. (Severity: LOW).
- [COMMAND_EXECUTION]: No shell commands or system-level calls are present in the instructions.
Audit Metadata