Versioned security assessment

Report ID: SA-87931E6F

7/8/2026, 4:40:52 AM

higgsfield-product-photoshoot security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
higgsfield-product-photoshoot
Version
v4
Maintainer
higgsfield-ai
Source
github.com/higgsfield-ai/skills/tree/main/higgsfield-product-photoshoot/
Coverage
1 Files scanned · 216 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static backtick findings are Markdown mode names, option labels, or sample output and were dismissed as false positives. The confirmed risks are remote installer execution through curl piped to sh, intended Higgsfield CLI execution, and auto-upload of local product images to a backend service. No prompt injection attempt was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 216 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 60 evidence locations

Capability review items (10)
Critical
SKILL.md:34-36
Ruby/shell backtick execution
```bash
The fenced bash block contains a curl-to-shell installer on line 35. Downloading and executing a remote script is a real remote code execution risk.
High
SKILL.md:35
Hardcoded URL
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
The hardcoded URL downloads an installer from raw.githubusercontent.com as part of the bootstrap flow. This is real network access tied to executable installation.
Medium
SKILL.md:27
Ruby/shell backtick execution
Brand-image generation via the `higgsfield product-photoshoot create` command. The CLI calls a backe
The skill is designed to run the external Higgsfield CLI and submit jobs to a backend. This is legitimate functionality, but it is real command and network execution.
Medium
SKILL.md:33
Ruby/shell backtick execution
1. If `higgsfield` is not on `$PATH`, install it:
This line starts a bootstrap flow that installs the Higgsfield CLI when missing. Installing external tooling from a skill changes local execution state.
Medium
SKILL.md:138-140
Ruby/shell backtick execution
Single command. Backend assembles the final prompt and submits to `gpt_image_2`. URLs print on stdou
The instructions require a CLI command that submits work to the GPT Image 2 backend. This is expected behavior, but it is still external command and network use.
Medium
SKILL.md:140-147
Ruby/shell backtick execution
```bash
The bash block instructs execution of higgsfield product-photoshoot create with user-derived prompt and image values. This requires argument validation and user consent for uploads.
Medium
SKILL.md:151-157
Ruby/shell backtick execution
```bash
The example shows running the Higgsfield CLI with a local image file. It is normal for the skill, but still confirms external command execution.
Medium
SKILL.md:159-164
Ruby/shell backtick execution
```bash
The example shows running the Higgsfield CLI with a local image file. It is normal for the skill, but still confirms external command execution.
Medium
SKILL.md:166-171
Ruby/shell backtick execution
```bash
The example shows running the Higgsfield CLI with an existing image file. It is normal for the skill, but still confirms external command execution.
Medium
SKILL.md:175-179
Ruby/shell backtick execution
`--image` accepts a local file path (auto-uploaded) OR an existing upload UUID. Repeat the flag for
The --image flag accepts a local path and auto-uploads it. That can disclose local product images to the external Higgsfield service.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical
SKILL.md:35
Pipe to shell pattern
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
The command pipes a remote installer directly into sh. This is a critical supply-chain and remote code execution risk if the script or transport is compromised.
RISK-002 Medium
SKILL.md:27SKILL.md:175
Third-Party Product Image Upload
The skill says local file paths are auto-uploaded and that the CLI calls a backend service. This can move confidential product images outside the local environment.
Lines 27 and 175 directly state backend submission and automatic upload of local image paths, so the data egress risk is clear.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is executed through a shell pipe.
    Replace curl piped to sh with a pinned package install, checksum verification, and explicit user confirmation before installation.
  2. FIX-002
    Medium
    CLI commands accept user-derived prompts and image paths.
    Validate mode, count, and aspect ratio values, quote arguments safely, and avoid shell interpolation for user-provided values.
  3. FIX-003
    Medium
    Local product images can be uploaded to a third-party backend.
    Disclose the upload behavior, request consent for sensitive assets, and document data retention and access expectations.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable