The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md and references/prerequisites.md files contain instructions to install the higgsfield CLI via a shell script from the vendor's official GitHub repository (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh). The script is piped to sh for execution as part of the bootstrap process.
[COMMAND_EXECUTION]: The Python scripts (brandkit.py, build_brandbook.py, and render_brandbook_pdf.py) execute system commands using subprocess.run to manage image and document processing. These operations utilize standard utility binaries such as ImageMagick, LibreOffice, and Poppler components.
[EXTERNAL_DOWNLOADS]: The skill downloads configuration and assets from trusted or well-known sources, including a PPTX template from Google Docs and font files via the Google Fonts API.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as SVG files, HTML templates, and user-supplied images. It mitigates injection risks through a dedicated validate_svg function that sanitizes input by blocking active content, event handlers, and external references.
[PRIVILEGE_ESCALATION]: The references/prerequisites.md documentation describes installing system-level dependencies via sudo apt-get. The skill is instructed to always obtain explicit user consent before executing these commands.

higgsfield-brandkit