higgsfield

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). One or more URLs point to a direct raw GitHub install script (curlable .sh) and a malformed GitHub URL containing an embedded "\n" (possible injection/typosquat), both strong indicators of a risky download/install vector; the remaining links are documentation/badges/GitHub releases that look benign.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README contains an explicit shell-install command that pipes a remote script to the shell (curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh), which fetches and executes remote code at runtime (CI or user install), so it is a high-confidence runtime external dependency that can execute code.