Higgsfield Soul ID

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it asks the agent to run an unverified remote installer and upload face photos to train a reusable identity model without enough consent and privacy guardrails.

Review before installing. Only use this skill with photos you have the right to upload, and confirm you are comfortable sending them to Higgsfield to create a reusable identity model. Prefer installing the Higgsfield CLI through a pinned, verified release or official package path instead of allowing the agent to run the provided `curl | sh` command.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29
• Finding: Unverified Remote Installer Is Piped Directly Into a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete Code Snippet**: ```bash curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh ``` ### Technical Analysis The bootstrap instructions download a shell script from the mutable `main` branch of an external GitHub repository and execute the response immediately through `sh`. The command does not pin the installer to a release or immutable commit, verify a cryptographic signature or checksum, save the script for inspection, or request explicit user approval before execution. HTTPS protects the response in transit but does not establish that every future version of the upstream script is safe. Compromise of the repository, maintainer account, publishing workflow, or referenced installer dependencies could change the effective payload after this Skill has been reviewed. Installing the CLI may be necessary for the declared facial-model training workflow, but arbitrary remote shell execution exceeds the minimum privilege required. A safer installation method can install a specific, verified CLI release without granting mutable upstream content immediate shell execution. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release workflow, or another component capable of modifying `install.sh` on the `main` branch. 2. The attacker replaces or augments the installer with malicious shell commands. 3. A target invokes the Skill on a system where `higgsfield` is not present on `$PATH`. 4. The Agent follows the mandatory bootstrap instruction and retrieves the current attacker-controlled response. 5. The pipe sends that response directly to `sh` without integrity verification or inspection. 6. The malicious commands execute with all permissions available to the Agent's operating-system account. ### Impact As ...[truncated 804 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | sh` bootstrap command. 2. Prefer a trusted package manager or an official, version-pinned release package. 3. Pin downloads to an immutable release version or commit rather than the mutable `main` branch. 4. Publish and verify a cryptographic signature or trusted checksum before execution. 5. Download the installer to a local file first, validate it, and allow inspection before running it. 6. Obtain explicit user approval before installing software or executing an installer. 7. Run installation with the least-privileged account and avoid privilege elevation unless it is strictly necessary and separately approved. 8. Fail closed when signature, checksum, expected origin, or version verification does not succeed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Chaining Abuse

High

• Category: Tool Misuse

Content

1. If `higgsfield` is not on `$PATH`, install it:
   ```bash
   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
   ```
2. If `higgsfield account status` fails with `Session expired` / `Not authenticated`, ask the user to run `higgsfield auth login` (interactive) and wait for confirmation.
3. Soul training requires a paid plan (Basic+). If `higgsfield account status` shows free plan, tell the user before submitting.

• Confidence: 90% confidence
• Finding: The direct chaining of network retrieval into shell execution removes any opportunity to inspect the fetched content and creates a one-step path from external input to code execution. In an agent skill context, this is more dangerous because the instruction is embedded as part of normal workflow bootstrapping, making automatic or habitual execution more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to collect and submit multiple face photos to an external service for model training, but it does not require an explicit user-facing notice that biometric images will be uploaded, stored, and processed by a third party. Because facial data is highly sensitive and the skill creates a reusable identity model, the lack of an affirmative privacy/data-sharing warning meaningfully increases the risk of uninformed consent and privacy harm.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This guidance instructs users on uploading face photos for model training but does not warn that the images are biometric data that may create a persistent identity model. In the context of a skill explicitly designed to build a reusable digital twin, omission of privacy, consent, retention, and downstream-use warnings can lead users to disclose highly sensitive data without informed understanding.

External Script Fetching

Low

• Category: Supply Chain

Content

1. If `higgsfield` is not on `$PATH`, install it:
   ```bash
   curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
   ```
2. If `higgsfield account status` fails with `Session expired` / `Not authenticated`, ask the user to run `higgsfield auth login` (interactive) and wait for confirmation.
3. Soul training requires a paid plan (Basic+). If `higgsfield account status` shows free plan, tell the user before submitting.

• Confidence: 96% confidence
• Finding: The skill instructs piping a remote script directly into the shell via curl | sh, which executes unverified code from a network source with no integrity check, review step, or pinned version. If the upstream repository, delivery path, or content is compromised, the agent could run attacker-controlled code on the host.

Static analysis

No suspicious patterns detected.