The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a CLI installer from the author's official GitHub repository (higgsfield-ai/cli). This is a standard installation method for the vendor's own tooling and is performed only after user permission is obtained.
[COMMAND_EXECUTION]: The skill uses the Python subprocess module to call system utilities including ImageMagick, LibreOffice, and Poppler for image and document processing. These calls are constructed using list-based arguments, which prevents command injection by ensuring inputs are not interpreted as shell commands.
[DATA_EXFILTRATION]: The brandkit.py script contains a network fetching utility that validates hostnames before making requests. It verifies that the target IP address is global and public, which mitigates Server-Side Request Forgery (SSRF) risks and prevents unauthorized access to the user's local network resources.
[REMOTE_CODE_EXECUTION]: The skill implements a strict SVG validation engine that scans for and rejects potentially malicious content such as embedded <script> tags, event handlers (e.g., onclick), and external CSS imports. This ensures that user-supplied or generated visual assets do not trigger unintended code execution during processing.

higgsfield-brandkit