Skip to content
skillsafebeta
← Report library
Purpose / Other

Higgsfield Product Photoshoot Skill Security Audit

What the author says it does (original text)

|

Independent security check

Do not install or run it yet

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Runs a downloaded program right away

Source references: 2
What we found

This line runs the downloaded content without giving you a chance to read it first.

Why this matters

Once run, the downloaded program could read or change your files. The owner of the website can also replace the program without changing its URL.

This is an active installation instruction: when `higgsfield` is absent from PATH, the agent downloads the script currently served by a GitHub repository and immediately pipes it to a shell. No commit is pinned and no prior review or hash verification is specified. If the repository or script were compromised, it would run with the current user's permissions and could access or change data available to that user. A user can ask for a pinned version and checksum, or require the script to be saved, reviewed, and approved before execution.

SKILL.md:35In the instructionsOpen original file
   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
Show 1 other places
SKILL.md:31In the instructionsOpen original file
Before any other command:1. If `higgsfield` is not on `$PATH`, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
High risk

The bootstrap pipes a remote installer directly into a shell

Source references: 2
What we found

When higgsfield is absent, the agent is instructed to download install.sh from GitHub and execute it immediately, without pinning a version or verifying its contents or checksum. A compromised repository, delivery path, or script would run with the current user's privileges.

Why this matters

The installer could read or modify files accessible to the user, install additional software, access available credentials, or establish persistent configuration. The supplied evidence does not show the script's contents or installation scope.

The candidate's cited line 22 only permits Bash and does not itself establish remote execution. However, the active installation instruction at lines 31–35 directly pipes an unpinned remote `install.sh` into `sh`. This supports the stated supply-chain and current-user-permission risk, though it does not prove the script is malicious or was executed. A user can require a pinned release, checksum verification, and review before execution.

SKILL.md:22In the instructionsOpen original file
argument-hint: "[--mode <mode>] [--count N] [prompt]"allowed-tools: Bash---
Show 1 other places
SKILL.md:31In the instructionsOpen original file
Before any other command:1. If `higgsfield` is not on `$PATH`, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```2. If `higgsfield account status` fails with `Session expired` / `Not authenticated`, ask the user to run `higgsfield auth login` (interactive) and wait for confirmation.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Local product images and requirement text are sent to external services

Source references: 4
What we found

The command automatically uploads local images. Interview-derived intent is passed as a prompt to Higgsfield's backend, which then submits the assembled prompt and generation job to gpt_image_2.

Why this matters

Unreleased products, packaging, people, brand assets, or marketing plans may leave the device and become subject to Higgsfield's and the model provider's retention, access, and usage policies. The evidence does not state retention periods, deletion controls, or training use.

This transfer is part of the skill's intended generation function, but it is still external disclosure: interview-derived requirements are submitted as `--prompt`, local `--image` files are auto-uploaded, and the backend submits the task to `gpt_image_2`. Unreleased products, people, brand assets, metadata, and requirement text may therefore leave the device. The shown source does not state recipients, retention, or training use. Users can ask for the privacy policy and restrict uploads to authorized, sanitized images.

SKILL.md:141In the instructionsOpen original file
```bashhiggsfield product-photoshoot create \  --mode <mode> \  --prompt "<short user-intent description from interview answers>" \  [--image <path-or-upload-id>]... \  [--count <1-10>] \  [--aspect_ratio <override>]```
Show 3 other places
SKILL.md:175In the instructionsOpen original file
`--image` accepts a local file path (auto-uploaded) OR an existing upload UUID. Repeat the flag for multiple references.
SKILL.md:27In the instructionsOpen original file
Brand-image generation via the `higgsfield product-photoshoot create` command. The CLI calls a backend prompt enhancer that holds mode-specific photography vocabulary and structural templates, then submits to `gpt_image_2` and returns image URLs.
SKILL.md:138In the instructionsOpen original file
Single command. Backend assembles the final prompt and submits to `gpt_image_2`. URLs print on stdout.```bashhiggsfield product-photoshoot create \  --mode <mode> \  --prompt "<short user-intent description from interview answers>" \  [--image <path-or-upload-id>]... \  [--count <1-10>] \  [--aspect_ratio <override>]
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

The actual enhanced prompt is intentionally hidden from the user

Source references: 4
What we found

The backend creates the final prompt, the agent is forbidden to compose it, and the delivery rules explicitly withhold the enhanced text. The user therefore sees result URLs but cannot verify from the response the complete instructions sent to the external model.

Why this matters

If the backend introduces unsuitable brand, person, copyright, or other content constraints, their origin may be harder to identify before using the images. This also reduces auditability for commercial-content compliance. The evidence does not show that harmful content is actually added.

Hiding the enhanced prompt is an explicit live behavior, not merely an example: the backend assembles it, the agent must not write it, and delivery must omit both the enhanced text and internal model names. That matches the skill's URL-focused UX, but prevents users from checking in the reply exactly what text the external model received, which may affect brand, compliance, or sensitive-content review. Users can ask whether an audit record or optional prompt preview is available before using it.

SKILL.md:45In the instructionsOpen original file
4. Skip questions whose answer is obvious from context (uploaded image, prior turn, brand memory).5. Never write the gpt_image_2 prompt yourself — backend assembles it.6. Polling is silent. Wait until URLs are ready, then deliver.
Show 3 other places
SKILL.md:193In the instructionsOpen original file
Print the image URLs as a short bulleted list. No JSON, no IDs, no internal model names, no enhanced prompt text. If a job failed, mention it briefly with the failure status.
SKILL.md:204In the instructionsOpen original file
- Does not write gpt_image_2 prompts directly. Backend owns prompt assembly.- Does not auto-pick a different image-gen model. Always `gpt_image_2`.- Does not replace `higgsfield-generate` Marketing Studio for branded video / avatar workflows.
SKILL.md:138In the instructionsOpen original file
Single command. Backend assembles the final prompt and submits to `gpt_image_2`. URLs print on stdout.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill generates product visuals: the agent selects a mode, gathers brief requirements, and calls the Higgsfield CLI; Higgsfield's backend assembles the final prompt, submits it to gpt_image_2, and returns image URLs.

View source
SKILL.md:27In the instructionsOpen original file
Brand-image generation via the `higgsfield product-photoshoot create` command. The CLI calls a backend prompt enhancer that holds mode-specific photography vocabulary and structural templates, then submits to `gpt_image_2` and returns image URLs.
SKILL.md:138In the instructionsOpen original file
Single command. Backend assembles the final prompt and submits to `gpt_image_2`. URLs print on stdout.

It accepts either local image paths or existing upload UUIDs; local images are automatically uploaded, and multiple references may be supplied.

View source
SKILL.md:175In the instructionsOpen original file
`--image` accepts a local file path (auto-uploaded) OR an existing upload UUID. Repeat the flag for multiple references.

A Higgsfield account session is required; if the session is expired or unauthenticated, the user is asked to complete an interactive login.

View source
SKILL.md:37In the instructionsOpen original file
   ```2. If `higgsfield account status` fails with `Session expired` / `Not authenticated`, ask the user to run `higgsfield auth login` (interactive) and wait for confirmation.
Start here · InstructionsSKILL.md
higgsfield-product-photoshoot
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
argument-hint: "[--mode <mode>] [--count N] [prompt]"allowed-tools: Bash---
SKILL.md:34In the instructionsOpen original file
1. If `higgsfield` is not on `$PATH`, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
SKILL.md:140In the instructionsOpen original file
```bashhiggsfield product-photoshoot create \
Connect to websites
SKILL.md:35In the instructionsOpen original file
   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
SKILL.md:197In the instructionsOpen original file
3 lifestyle shots ready:- https://cdn.higgsfield.ai/.../job_abc.jpg- https://cdn.higgsfield.ai/.../job_def.jpg
SKILL.md:198In the instructionsOpen original file
- https://cdn.higgsfield.ai/.../job_abc.jpg- https://cdn.higgsfield.ai/.../job_def.jpg- https://cdn.higgsfield.ai/.../job_ghi.jpg
Lines read
216
File checksum (to compare versions)
f9c94f4f7b139f35bdf18f0085f712aa3a74d7051c2c2df0427b248e0cdfc67d