Versioned security assessment

Report ID: SA-245AE9A7

7/6/2026, 3:18:44 PM

higgsfield-marketplace-cards security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
higgsfield-marketplace-cards
Version
v3
Maintainer
higgsfield-ai
Source
github.com/higgsfield-ai/skills/tree/main/higgsfield-marketplace-cards/
Coverage
1 Files scanned · 89 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The audit confirms a critical pipe-to-shell installer on SKILL.md line 26. It also confirms user-driven Higgsfield CLI execution and remote processing of prompts and image references. Most Markdown backtick and placeholder URL detections were false positives.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 89 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 30 evidence locations

Capability review items (7)
Critical
SKILL.md:26
Ruby/shell backtick execution
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The line instructs installing the CLI by piping a remote script into sh. That pattern executes downloaded code without local review.
High
SKILL.md:26
Hardcoded URL
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The hardcoded GitHub URL is used to download an installer script for execution. Network retrieval of executable install code is a real supply-chain risk.
Medium
SKILL.md:21
Ruby/shell backtick execution
Create marketplace-ready product visuals with `higgsfield marketplace-cards create`.
The line names the Higgsfield CLI command that the skill is designed to run. This is legitimate functionality, but it confirms external command execution.
Medium
SKILL.md:66
Ruby/shell backtick execution
Build and run one `higgsfield marketplace-cards create` command from the user's request.
The line directs the agent to build and run a Higgsfield command from the user request. User-controlled arguments need strict validation and safe invocation.
Medium
SKILL.md:68
Ruby/shell backtick execution
For common bundles, use `--scope <main|product-images|aplus|full-set>`, `--prompt "<short product an
The command template includes user-controlled prompts, paths, and context values. If passed through a shell unsafely, those values can create injection risk.
Medium
SKILL.md:72
Ruby/shell backtick execution
- Product images: `higgsfield marketplace-cards create --scope product-images --prompt "sparkling pe
The example is a real Higgsfield CLI invocation that uploads or processes a local product image. It is expected behavior, but still an external command risk.
Medium
SKILL.md:73
Ruby/shell backtick execution
- Full set: `higgsfield marketplace-cards create --scope full-set --prompt "premium skincare serum,
The example is a real Higgsfield CLI invocation with prompt and image inputs. It confirms external command and remote generation behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical
SKILL.md:26
Pipe to shell pattern
1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl
The instruction uses curl piped directly to sh from a remote repository. This is a classic pipe-to-shell install pattern and should be blocked until changed.
RISK-002 Medium
SKILL.md:22SKILL.md:68
Remote Processing of User Assets
The skill sends user listing prompts and optional image references to Higgsfield backend services. This is expected for generation, but it needs clear consent because assets may contain product or brand data.
Line 22 describes backend enhancer and remote jobs, while line 68 passes prompts and image references into the CLI.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly to the shell.
    Replace curl-to-shell installation with a verified package, checksum validation, or explicit manual install steps.
  2. FIX-002
    Medium
    Commands are built from user-provided prompts, paths, and context.
    Use argument arrays, validate enumerated flags, quote paths safely, and reject shell metacharacters in free text.
  3. FIX-003
    Medium
    Product images and listing context are processed by a remote backend.
    Add a clear consent step before uploading local assets or sensitive product information.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable