The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides troubleshooting instructions for installing the Higgsfield CLI using the pattern curl -sSL https://install.higgsfield.ai/install.sh | sh. This method is highly insecure as it executes code from a remote, unverified third-party server directly with the user's shell privileges without integrity checks.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that incorporate unvalidated user-controlled variables. Specifically, the {slug} variable, derived from the product name during the interview phase, is interpolated directly into commands like mkdir -p kampagne-{slug} and higgsfield generate ... --output kampagne-{slug}/.... This provides a direct path for command injection if a user provides a product name containing shell metacharacters.
[COMMAND_EXECUTION]: The skill also executes various local commands for orchestration, including starting a Python web server (python -m http.server) and running the Higgsfield CLI for video generation and reframing.
[EXTERNAL_DOWNLOADS]: The skill fetches external code and assets from multiple sources, including JavaScript libraries from cdn.jsdelivr.net (GSAP, ScrollTrigger), web fonts from fonts.googleapis.com, and media assets via the Higgsfield API.
[PROMPT_INJECTION]: The skill ingests untrusted user data during the initial product interview (Phase 1) and interpolates this content into Brand Briefs and subsequent AI generation prompts without sanitization or boundary markers. This exposes the skill to indirect prompt injection, where malicious user input could manipulate the orchestration logic or the content generated by the Higgsfield models.

image-to-campaign-funnel-generator