higgsfield

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill workflow requires the agent to execute curl -X PUT commands to upload media files to presigned URLs generated by the Higgsfield API.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which presents a surface for potential indirect prompt injection.
  • Ingestion points: The value parameter in the medias array accepts public https:// URLs for image and video reference.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content in processed media are provided in the skill instructions.
  • Capability inventory: The skill possesses the ability to trigger image and video generation and execute shell commands via curl.
  • Sanitization: The instructions do not specify any validation or sanitization steps for data fetched from external URLs.
  • [EXTERNAL_DOWNLOADS]: The skill installation involves connecting to a remote MCP server hosted at https://mcp.higgsfield.ai/mcp.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:18 PM