Skip to content
skillsafebeta
← Report library
Purpose / Other

Higgsfield Youtube Thumbnail Skill Security Audit

What the author says it does (original text)

|

Independent security check

Do not install or run it yet

Files checked
4
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Runs a downloaded program right away

Source references: 2
What we found

This line runs the downloaded content without giving you a chance to read it first.

Why this matters

Once run, the downloaded program could read or change your files. The owner of the website can also replace the program without changing its URL.

When `higgsfield` is missing, this live installation instruction downloads a script and immediately executes it with `sh`. If the repository, delivery path, or script is later compromised, it could access or modify data with the current user's permissions. Although the source is public GitHub, no commit pin, checksum, or review step is shown. The user can ask for a pinned version and checksum, or inspect the downloaded script before execution.

SKILL.md:20In the instructionsOpen original file
   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
Show 1 other places
SKILL.md:18In the instructionsOpen original file
1. If `higgsfield` is missing, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
High risk

The installation step executes an unpinned, unverified remote script directly in a shell

Source references: 1
What we found

When the CLI is missing, the Skill downloads install.sh from GitHub's mutable main branch and pipes it immediately to sh, without giving the user a reviewed or integrity-checked artifact.

Why this matters

If the source, account, network path, or a future script revision is compromised, the script runs with the current user's permissions and could access or alter any files, credentials, and configuration available to that user. The supplied evidence does not show that such compromise occurred.

The candidate matches the source: when the CLI is absent, `install.sh` from the mutable `main` branch is piped directly to a shell. The shown procedure has no pinned commit, signature, or checksum, so the executed content can change with the remote branch. This risk applies only when installation is triggered and does not prove the script is malicious or was run. The user can request a verifiable pinned release or review the script first.

SKILL.md:18In the instructionsOpen original file
1. If `higgsfield` is missing, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```2. If `higgsfield account status` reports `Session expired` or `Not authenticated`, ask the user to run `higgsfield auth login`, then wait.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Face photos and logos are uploaded to Higgsfield

Source references: 5
What we found

The Skill passes faces and logos through `--image`, states that local paths are automatically uploaded, and uses face images for exact identity matching. This fits thumbnail generation, but supplying an asset does not by itself establish consent to third-party upload, particularly for another person's photo.

Why this matters

Faces are sensitive identity data, while logos and unreleased artwork may be confidential. Once uploaded, they leave the local environment and become subject to Higgsfield's retention, training, access, and deletion practices.

For thumbnail generation, the Skill sends attached face photos and logos to Higgsfield as references. Local paths are automatically uploaded, and the face prompt requests a precise biometric likeness. This is purpose-related processing, but it transfers potentially sensitive face and brand material to a third party. Supplying a file does not necessarily mean every depicted person consented. The user can ask for retention, training-use, and deletion terms and submit only material they are authorized to process.

SKILL.md:70In the instructionsOpen original file
Pass face photos first in character order, then the logo. Repeat `--image` for every reference. When two or more references are attached, the prompt's first line must be a manifest such as:```textIMAGE REFERENCES: image 1 = CHARACTER 1 face reference; image 2 = brand logo.```Local paths are auto-uploaded. Previous completed job IDs also work as `--image` inputs.
Show 4 other places
SKILL.md:94In the instructionsOpen original file
For each photo-referenced person, include:```textCHARACTER N: the person from attached face reference #K — IDENTITY LOCK: reproducethis exact person with a photographic identity match — same bone structure, eye shape,nose, lips, jawline, skin tone, hairline and hair texture. Do not beautify, average,or restyle the face. Expression: <emotion phrase>.```
SKILL.md:126In the instructionsOpen original file
```bashhiggsfield generate create nano_banana_pro \  --aspect_ratio 16:9 \  --resolution 4k \  --image ./face-1.png \  --image ./logo.png \  --wait --json < thumbnail-prompt.txt```
SKILL.md:76In the instructionsOpen original file
Local paths are auto-uploaded. Previous completed job IDs also work as `--image` inputs.
SKILL.md:97In the instructionsOpen original file
```textCHARACTER N: the person from attached face reference #K — IDENTITY LOCK: reproducethis exact person with a photographic identity match — same bone structure, eye shape,nose, lips, jawline, skin tone, hairline and hair texture. Do not beautify, average,or restyle the face. Expression: <emotion phrase>.```
Low risk

Text-overlay previews contact Google Fonts and may fetch arbitrary background URLs

Source references: 4
What we found

The reference implementation requests Google Fonts in the browser and permits a URL to be assigned directly as the canvas image source. Those requests expose ordinary network metadata such as IP address and browser information to the relevant services, and cause the browser to visit the background URL.

Why this matters

In privacy-sensitive settings or when an internal image URL is used, the font or image host can observe the request. Image URLs containing access tokens or signed parameters may also appear in browser network records.

This risk is conditional on the user requesting a headline overlay and the browser-based reference implementation being used. It requests a font from Google Fonts and permits an image URL as `src`; the browser then contacts that address, exposing ordinary connection metadata to those servers. This is an implementation recipe, not proof it runs every time or leaks image contents. The user can require bundled local fonts and local background files, or block browser network access.

SKILL.md:171In the instructionsOpen original file
Keep the generated image text-free by default. When a headline overlay is requested, read `references/text-overlay-bake.md` and use one of its five presets: Beast, Fire, Neon Lime, Clean Glass, or Marker. The overlay path requires an environment capable of rendering HTML canvas; if unavailable, offer either the clean image or an explicitly approved baked-text regeneration. Never pretend an HTML preview is a flattened PNG.
Show 3 other places
references/text-overlay-bake.md:39In the instructionsOpen original file
<meta charset="utf-8"><link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet"><style>
references/text-overlay-bake.md:138In the instructionsOpen original file
  // 1) load Anton BEFORE drawing  const fontLink = document.createElement('link');  fontLink.rel = 'stylesheet';  fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';  document.head.appendChild(fontLink);  await document.fonts.load('120px "Anton"');  await document.fonts.ready;  // 2) background  const img = new Image();  img.crossOrigin = 'anonymous';        // else toDataURL fails on CORS (for URLs)  await new Promise((res, rej) => { img.onload = res; img.onerror = rej; img.src = src; });
references/text-overlay-bake.md:146In the instructionsOpen original file
  // 2) background  const img = new Image();  img.crossOrigin = 'anonymous';        // else toDataURL fails on CORS (for URLs)  await new Promise((res, rej) => { img.onload = res; img.onerror = rej; img.src = src; });
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Variants and automatic retries may consume multiple paid credits while retry details are withheld

Source references: 4
What we found

The Skill says this CLI workflow uses credits, may offer about four variants with a 16-generation cap, and may retry each hard failure twice. Normal delivery is instructed not to disclose retry mechanics. It does not state a total cost ceiling or require approval before retries.

Why this matters

A single thumbnail request can create several billable jobs, with additional costs from failure retries, 3D-logo rendering, and edits. The user may receive only final URLs without knowing the number of calls or credits consumed.

The source says the CLI uses credits, may propose about four variants, and permits up to 16 generations; a hard failure can also trigger two retries of the same prompt. Normal delivery hides retry mechanics. Although generation is the requested function and a cap exists, the price, whether retries count toward that cap, and whether paid retries require approval are not stated. The user can require per-call pricing, a total budget limit, and no retries or extra variants without confirmation.

SKILL.md:38In the instructionsOpen original file
6. Do not use `--count`. Every concept, emotion, or camera take gets its own prompt and generation call.7. `use_unlim` is not a current CLI parameter. Never add `--use-unlim`; if the user explicitly asks to use an unlimited allowance, explain that this workflow must run on credits in CLI or through a surface that supports that allowance.
Show 3 other places
SKILL.md:51In the instructionsOpen original file
- Ratio: `16:9` for YouTube by default, `9:16` for Shorts, or `4:5` for Instagram.- One final concept or a variant set. If unspecified and alternatives would materially help, offer a set of about four. Hard cap: 16 total generations.
SKILL.md:148In the instructionsOpen original file
On a hard failure, retry the same prompt at most twice. If visual inspection is unavailable, do not claim it passed; deliver the result for user review. Present every passing variant and let the user pick before making optional tweaks.
SKILL.md:175In the instructionsOpen original file
Return the passing `result_url` values with short semantic labels such as `shock / close-up` or `product / size contrast`. Mention the selected ratio and whether the deliverable is clean, overlay-ready, or text-baked. Do not expose internal prompts, job IDs, or retry mechanics unless the user asks.

Inside this skill

8 instruction sections

The Skill generates thumbnails through cloud models using the Higgsfield CLI. Local face and logo paths are automatically uploaded; the completed URL is delivered while the job ID is retained for later edits.

View source
SKILL.md:123In the instructionsOpen original file
Use Nano Banana Pro at explicit 4K. Write the final prompt to a temporary text file and pipe it on stdin so punctuation and multiline blocks are preserved safely:```bashhiggsfield generate create nano_banana_pro \  --aspect_ratio 16:9 \  --resolution 4k \  --image ./face-1.png \  --image ./logo.png \  --wait --json < thumbnail-prompt.txt```
SKILL.md:134In the instructionsOpen original file
Omit all `--image` flags when there are no references. For a variant set, make one call per distinct prompt. Keep the same references and settings; vary only the selected concept, expression, or camera-take line.The completed JSON result contains `id` and `result_url`. Preserve both privately: the URL is delivered; the ID is the source for later edits.

Before generation, the Skill checks account status and the current contracts of three models. If authentication is missing or expired, it requires the user to complete login before continuing.

View source
SKILL.md:22In the instructionsOpen original file
   ```2. If `higgsfield account status` reports `Session expired` or `Not authenticated`, ask the user to run `higgsfield auth login`, then wait.3. Confirm the locked model contracts when the catalog may have changed:   ```bash   higgsfield model get nano_banana_pro --json   higgsfield model get gpt_image_2 --json   higgsfield model get seedream_v5_pro --json   ```

The default workflow internally develops at least five concepts, generates selected variants in separate calls, and then checks identity, text, readability, and truthfulness.

View source
SKILL.md:57In the instructionsOpen original file
Read `references/thumbnail-frameworks.md`. Brainstorm at least five truthful concepts internally, across multiple frameworks, then select the strongest information gap with one focal subject and minimal clutter. Combine frameworks only when the result still reads in under one second at roughly 120px wide.
SKILL.md:140In the instructionsOpen original file
Inspect every result with host vision when available:- Referenced identities visibly match.- No stray text or watermark exists unless baked text was ordered.- Explicit baked text matches character-for-character.- The face/emotion and hero element remain readable at about 120px wide.- The concept truthfully matches the video promise.
Start here · InstructionsSKILL.md
higgsfield-youtube-thumbnail
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/text-overlay-bake.mdFull text included
  • references/thumbnail-frameworks.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
  • references/text-overlay-bake.mdSupporting file
  • references/thumbnail-frameworks.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:7In the instructionsOpen original file
argument-hint: "[video-topic-or-title] [--image <face-or-logo>] [--ratio 16:9|9:16|4:5]"allowed-tools: Bash---
SKILL.md:19In the instructionsOpen original file
1. If `higgsfield` is missing, install it:   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
SKILL.md:24In the instructionsOpen original file
3. Confirm the locked model contracts when the catalog may have changed:   ```bash   higgsfield model get nano_banana_pro --json
Connect to websites
SKILL.md:20In the instructionsOpen original file
   ```bash   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh   ```
references/text-overlay-bake.md:39In the instructionsOpen original file
<meta charset="utf-8"><link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet"><style>
references/text-overlay-bake.md:140In the instructionsOpen original file
  fontLink.rel = 'stylesheet';  fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';  document.head.appendChild(fontLink);
Lines read
519
File checksum (to compare versions)
e2afbe6fa106dcb47fdaa453d6cbf83d9bbe8572201268b10b9eac754232491f