higgsfield-soul-id

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is high-risk: the skill instructs piping a remote shell script from a raw GitHub URL directly to sh (curl | sh), which is an unsafe pattern for an unverified/unknown repository and can deliver arbitrary malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs at runtime to run remote code via curl piped to sh (install script): https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh, which directly executes fetched code and is required for the skill to run.