higgsfield-product-360
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest untrusted user data—such as product categories, brand moods, and descriptions—to construct complex prompts for Higgsfield video and image generation models. This creates a surface for indirect prompt injection. \n
- Ingestion points: User input regarding product category, platform, brand mood, and desired features as outlined in the Prompt-building workflow of
SKILL.md. \n - Boundary markers: Absent; the instructions do not implement explicit delimiters or warnings to ignore instructions embedded within the user-provided text. \n
- Capability inventory: The skill utilizes
mcp__higgsfield__generate_videoandmcp__higgsfield__generate_imagetools to act upon the generated prompts. \n - Sanitization: No filtering, escaping, or validation of user-supplied strings is mentioned before they are interpolated into the final prompt sent to the generation models.
Audit Metadata