higgsfield-ai/skills higgsfield-websites
Checked the catalogued skill at higgsfield-websites.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
7 suppressed by AI triage
Documentation contains an outbound curl command, not executed automatically.
The curl|sh pattern appears only in documentation, not run by the agent.
Reference to a raw script in documentation is not an actual vulnerable dependency.
The matched text is a reference to path traversal patterns in documentation, not an actual traversal in code.
The reference documents normal use of relative paths, not code that performs actual traversal.
The fetch targets an internal domain and is part of a server‑side proxy, not an external data exfiltration.
The call uses a relative path to an internal API, which is safe and documented.