higgsfield-models

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation (MODELS-DEEP-REFERENCE.md — e.g., the "Grok Imagine Video" and "Image-to-video"/"Video editing" sections) explicitly requires providing and fetching direct, publicly accessible image/video URLs and describes using those external assets (public URLs) to drive generation and edits, meaning untrusted third‑party content would be ingested and could materially influence model actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly requires fetching user-supplied public media URLs at runtime (e.g., "video_url: " and "image_url: " used by grok-imagine-video / image editing and the various reference-image/video workflows), and those fetched assets are injected as generation references that directly control model outputs.