The remote installation instruction pipes an unpinned script from a mutable branch directly into a shell, creating a critical supply-chain execution risk. Other backtick detections are Markdown formatting, while user-derived command arguments lack explicit shell-safety guidance.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The skill explicitly instructs piping a remotely downloaded script from a mutable branch into sh. This executes unverified upstream content with the agent's privileges.
The skill builds a shell command from user requests but does not require structured argument passing, escaping, or rejection of shell substitutions.
Lines 66-68 direct command construction from user intent and include multiple free-text values. No argument-safety requirement appears in those instructions.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The URL targets a mutable branch and supplies a script for immediate execution. A repository compromise or upstream change could deliver arbitrary code.
Most static findings are markdown code spans for options, asset names, sample commands, or output placeholders. Confirmed risks are the external Higgsfield CLI execution path, user-derived command arguments, a curl-to-shell installer, and external backend processing of product data.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The bootstrap instruction uses curl piped directly to sh. This is a classic unsafe installer pattern because downloaded code runs immediately without inspection or checksum verification.
The skill states that the CLI calls a backend enhancer and creates remote image jobs. User product images, listing intent, and brand context may leave the local workspace.
The prose directly describes a backend enhancer and command arguments for images, prompts, and brand context. This is expected functionality, but it is a real privacy and data-transfer consideration.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
This line provides a curl command piped into sh to install the CLI. Running downloaded installer content directly in a shell is a remote code execution risk.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The hardcoded GitHub URL is used as a remote installer source and is piped into a shell. If the remote content or transport chain is compromised, the install step can execute attacker-controlled code.
Create marketplace-ready product visuals with `higgsfield marketplace-cards create`.
The skill tells the agent to use the Higgsfield CLI to create marketplace assets. This is intended behavior, but it still executes an external local command that may contact a remote service.
Build and run one `higgsfield marketplace-cards create` command from the user's request.
The skill explicitly instructs the agent to build and run a Higgsfield CLI command from the user request. User-derived arguments passed through Bash create command execution and injection risk if not escaped.
For common bundles, use `--scope <main|product-images|aplus|full-set>`, `--prompt "<short product an
The command accepts user-derived prompts, local image paths, upload IDs, and context flags. Without enforced argument-array execution or validation, these values can affect shell behavior or disclose local assets.
The audit confirms a critical pipe-to-shell installer on SKILL.md line 26. It also confirms user-driven Higgsfield CLI execution and remote processing of prompts and image references. Most Markdown backtick and placeholder URL detections were false positives.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The instruction uses curl piped directly to sh from a remote repository. This is a classic pipe-to-shell install pattern and should be blocked until changed.
The skill sends user listing prompts and optional image references to Higgsfield backend services. This is expected for generation, but it needs clear consent because assets may contain product or brand data.
Line 22 describes backend enhancer and remote jobs, while line 68 passes prompts and image references into the CLI.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The hardcoded GitHub URL is used to download an installer script for execution. Network retrieval of executable install code is a real supply-chain risk.
Create marketplace-ready product visuals with `higgsfield marketplace-cards create`.
The line names the Higgsfield CLI command that the skill is designed to run. This is legitimate functionality, but it confirms external command execution.
Build and run one `higgsfield marketplace-cards create` command from the user's request.
The line directs the agent to build and run a Higgsfield command from the user request. User-controlled arguments need strict validation and safe invocation.
For common bundles, use `--scope <main|product-images|aplus|full-set>`, `--prompt "<short product an
The command template includes user-controlled prompts, paths, and context values. If passed through a shell unsafely, those values can create injection risk.
The example is a real Higgsfield CLI invocation that uploads or processes a local product image. It is expected behavior, but still an external command risk.
The static analyzer correctly identified real Bash command and network behavior in SKILL.md. Most backtick hits are Markdown formatting, but the installer instruction pipes a remote script into a shell, so publication should wait for safer installation guidance.
1
Files scanned
89
Lines analyzed
4
Review items
1
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md instructs users to run a remote GitHub installer through curl and pipe it directly into sh. This gives the downloaded script immediate shell execution and creates supply-chain and command execution risk.
The dangerous pipe-to-shell pattern is explicit on line 26 and is part of the skill workflow. I did not find evidence of malicious intent, but the execution risk is direct.
The skill allows Bash and instructs the assistant to run Higgsfield CLI commands that call a backend service and create image jobs. This is expected for the skill, but it executes external commands and sends prompt and image context to a remote backend.
The file clearly grants Bash access and gives concrete CLI commands. The risk is contextual because the CLI is central to the skill, but user assets and prompts may leave the local environment.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Many external command detections are Markdown inline code, asset names, scopes, or output placeholders. The weak cryptographic algorithm and system reconnaissance detections are not supported by the visible SKILL.md lines.
The cited lines contain documentation text, placeholders, or normal product instructions rather than cryptographic code or reconnaissance commands. No evidence found for those scanner claims.
Evaluated 49 static findings across 5 categories. 48 are false positives: 41 external_commands are markdown CLI examples for the legitimate higgsfield binary, 3 network findings point to the official GitHub installer and placeholder output URLs, 2 weak crypto findings are misclassifications of YAML frontmatter and UX rules, and 1 system reconnaissance finding is a safety instruction. 1 true positive (pipe-to-shell install pattern on line 26) is the documented official install method for a well-known CLI tool with no obfuscation or hidden behavior.