Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 8:06:29 AM

higgsfield-product-photoshoot security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
higgsfield-product-photoshoot
Version
v0.12.0
Maintainer
higgsfield-ai
Coverage
1 Files scanned Β· 216 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static detections are false positives from Markdown code spans for modes, options, and sample output. The real issues are the curl-to-shell installer, Bash CLI execution, and local image auto-upload to an external backend. No prompt injection attempt was found in SKILL.md.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned Β· 216 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (8)
Critical
Ruby/shell backtick execution
```bash
The fenced bootstrap command downloads a remote installer and executes it with sh. That gives the remote script shell execution on the user host.
High
Hardcoded URL
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
The URL points to a remote installer that is piped into sh. A changed or compromised installer would execute code on the user host.
Medium
Ruby/shell backtick execution
Single command. Backend assembles the final prompt and submits to `gpt_image_2`. URLs print on stdou
This section directs a single CLI command that submits prompt data to an external backend. The Bash and network workflow is security relevant.
Medium
Ruby/shell backtick execution
```bash
The command block invokes higgsfield with user-derived prompt text and optional image paths. It runs an external CLI and sends data to a backend.
Medium
Ruby/shell backtick execution
```bash
The example runs the Higgsfield CLI with a local image file. It is intended, but it normalizes external command execution and upload.
Medium
Ruby/shell backtick execution
```bash
The example runs the Higgsfield CLI with a local image file. It is intended, but it still demonstrates external command execution and upload.
Medium
Ruby/shell backtick execution
```bash
The example runs the Higgsfield CLI with a local image file. It is intended, but it still demonstrates external command execution and upload.
Medium
Ruby/shell backtick execution
`--image` accepts a local file path (auto-uploaded) OR an existing upload UUID. Repeat the flag for
This line says local image paths are auto-uploaded through the CLI. That can disclose local files if paths are not user-selected and confirmed.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
The command pipes a downloaded script directly to sh. This is a classic remote code execution installation pattern.
RISK-002 Medium
Local Product Images Auto-uploaded to External Backend
The skill says local image paths are auto-uploaded, and generation submits data through the Higgsfield CLI. This can disclose product assets without clear upload consent.
Line 175 explicitly says local file paths are auto-uploaded. Lines 138-146 show the CLI submits generation data to the backend.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer executes from a pipe to shell.
    Use a pinned package install, checksum verification, and explicit user confirmation before any install command runs.
  2. FIX-002
    Medium
    CLI commands run through Bash with user-supplied prompt and image paths.
    Validate mode, count, aspect ratio, and image paths before invoking Bash, and quote every argument.
  3. FIX-003
    Medium
    Local image paths are auto-uploaded to an external service.
    Ask users to confirm each file upload and warn that product images leave the local machine.
  4. FIX-004
    Low
    Network and account requirements are easy to miss.
    Document that the skill requires Higgsfield authentication and sends data to Higgsfield services.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Content hash
139c38f3b8a33a4ef37a1066850e4bcddc0976b4143cc6ea0c3b7ad9de3b3b9e
Tree hash
73ad5e5e1f95ee2d06ed795efa4f16056c96a242dd31e5dd3a969bccea90abae
Skill path
skills/higgsfield-ai/higgsfield-product-photoshoot
Audit payload hash
2493a41e774960991929dcbcd55886a5

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable