image-to-campaign-funnel-generator

SUSPICIOUS. The skill's core behavior is broadly consistent with its marketing-asset purpose and it does not request disproportionate credentials or exfiltrate local secrets. The main issue is install trust: it steers users to a curl|sh Higgsfield installer that does not match the safer official npm-documented path, while the skill itself comes from a personal repo. This is not confirmed malware, but the remote installer guidance raises medium supply-chain risk.