The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the higgsfield CLI from the author's official GitHub repository (github.com/higgsfield-ai/cli) if it is not already present.
[REMOTE_CODE_EXECUTION]: During the bootstrap phase, the skill executes a shell script downloaded directly from the vendor's repository (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh). This is a legitimate installation method for the vendor's own tooling.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to interact with the Higgsfield platform, including complex command construction that uses temporary files to pass JSON-structured arguments for avatars and product data.
[INDIRECT_PROMPT_INJECTION]: The skill features capabilities to fetch content from external URLs to generate brand kits and product entities, creating a potential surface for indirect prompt injection.
Ingestion points: higgsfield marketing-studio products fetch --url <url> and higgsfield marketing-studio brand-kits fetch --url <url> as documented in references/marketing-products.md and references/marketing-brand-kits.md.
Boundary markers: There are no explicit instructions to the agent to treat the imported content as untrusted or to wrap it in delimiters.
Capability inventory: The agent has access to the Bash tool to execute a wide variety of CLI commands as seen in SKILL.md.
Sanitization: The skill relies on the Higgsfield CLI and backend to handle the scraping and processing of the external data before it is returned as structured entities.

higgsfield-generate