Higgsfield Soul ID

• Analyzed: May 4, 2026, 4:26 PM
• Findings: 1
• Version: 1.0.0
• Hash: 06b549ffa0ebec2672d2768ed831b1b5acb0103ea7a688e3aab4beeb43cf189e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle uses a high-risk 'curl | sh' pattern in SKILL.md to install a CLI tool from a remote GitHub repository (higgsfield-ai/cli). While this behavior is common in developer tools, it constitutes an unverified remote code execution risk within the agent's environment. There is no evidence of intentional malice, but the combination of shell access, remote script execution, and the handling of authentication tokens makes it a significant security concern.