higgsfield

SUSPICIOUS. The skill’s core behavior is locally scoped and consistent with a recall/logging assistant, with no explicit credential use, download-execute chain, or third-party data exfiltration in the provided text. However, the explicit directive to run silently in the background and modify outputs without telling the user is a concealment/autonomy concern that makes the skill medium risk.

No explicit malware is evident because the fragment is only a permissions/allowlist manifest. However, it grants broad shell execution capabilities (git push, python3, gh with wildcards) and broad write access to code/docs and repo subtrees including .claude/** and db/**. This significantly increases the potential impact of any upstream compromise or untrusted instruction reaching the agent. Treat as a high-privilege policy requiring tight enforcement boundaries, least-privilege review, and strong isolation/approval for command execution and write operations.