higgsfield-generate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This set includes a direct raw GitHub URL to an install.sh that the skill tells users to curl | sh — piping an unreviewed shell script from an external repo is a high-risk distribution vector for malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow includes a URL-driven Marketing Studio flow where the CLI fetches a user-supplied product URL at runtime (higgsfield marketing-studio products fetch --url ... --wait), which can ingest scraped third-party page text (outsider-authored free text) into the generation pipeline/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's bootstrap step instructs running curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh which fetches and immediately executes a remote install script at runtime and is required if the CLI is missing.