The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md and CLAUDE.md recommend installing the Higgsfield CLI by piping a remote shell script directly to the system shell (curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh). While this originates from the service's official repository, executing unverified remote scripts is a high-risk practice.
[COMMAND_EXECUTION]: The Python scripts scripts/compile-dna.py and scripts/compose-video.py use subprocess.run to invoke system binaries such as ffmpeg, ffprobe, and npx. These commands process data derived from user-provided storyboard files and API responses, which can present a risk if inputs are not strictly sanitized.
[EXTERNAL_DOWNLOADS]: The scripts/compose-video.py script automatically downloads media assets from external URLs generated at runtime by AI service providers using urllib.request.urlretrieve.
[DATA_EXFILTRATION]: The skill includes scripts/content-engine-bridge.sh, which implements a telemetry mechanism. It collects system-specific metadata, including current repository paths, branch names, and CLAUDE_SESSION_ID, and logs this information to a local file at ~/.config/content-engine/generation-log.jsonl.
[PROMPT_INJECTION]: The skill architecture described in extensions/README.md allows the agent to discover and execute scripts from a local extensions/ directory. This creates a surface for indirect prompt injection or execution of unverified code if malicious files are introduced into the project environment.
Ingestion points: Shot and scene descriptions in storyboard.md and scene-brief.md are processed by generation scripts.
Boundary markers: No specific delimiters are used to separate user-provided content from executable prompt logic.
Capability inventory: Subprocess execution of media tools, network downloads, and local file writing across all core scripts.
Sanitization: No explicit sanitization or filtering of external or storyboard content before interpolation into commands.

content-engine