The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions in SKILL.md and references/prerequisites.md to download a shell script from a remote GitHub repository (higgsfield-ai/cli) and pipe it directly to a shell for execution (| sh). This constitutes an unverified remote code execution risk.
[COMMAND_EXECUTION]: Several Python scripts, including scripts/brandkit.py, scripts/build_brandbook.py, and scripts/render_brandbook_pdf.py, use the subprocess module to execute external shell commands. These commands invoke system utilities such as ImageMagick, rsvg-convert, and LibreOffice to perform media manipulation and document rendering.
[PRIVILEGE_ESCALATION]: The references/prerequisites.md file provides commands for the agent to install system-level dependencies using sudo apt-get install, which requires the agent to acquire elevated administrative permissions on the host.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch external resources, such as SVG logo files from arbitrary URLs, font assets from Google Fonts, and document templates from Google Docs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for indirect prompt injection. 1. Ingestion points: External SVGs fetched in scripts/brandkit.py and document assets analyzed in references/asset-analysis.md. 2. Boundary markers: The skill uses specialized prompt blocks like [BRAND LOCK — DO NOT DEVIATE] to enforce constraints, but these are not foolproof against injection in processed data. 3. Capability inventory: The agent has the ability to execute shell commands, perform network operations, and write files. 4. Sanitization: There is a validate_svg function that checks for scripts and event handlers in SVG files, providing a layer of defense against some injection vectors.

higgsfield-brandkit