higgsfield
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow requires the agent to execute
curl -X PUTcommands to upload media files to presigned URLs generated by the Higgsfield API. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which presents a surface for potential indirect prompt injection.
- Ingestion points: The
valueparameter in themediasarray accepts publichttps://URLs for image and video reference. - Boundary markers: No explicit delimiters or instructions to ignore embedded content in processed media are provided in the skill instructions.
- Capability inventory: The skill possesses the ability to trigger image and video generation and execute shell commands via
curl. - Sanitization: The instructions do not specify any validation or sanitization steps for data fetched from external URLs.
- [EXTERNAL_DOWNLOADS]: The skill installation involves connecting to a remote MCP server hosted at
https://mcp.higgsfield.ai/mcp.
Audit Metadata