The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md recommend installing the Higgsfield CLI using a piped shell command: curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. As this URL points to the official repository of the skill author (higgsfield-ai), it is considered a legitimate vendor resource.
[EXTERNAL_DOWNLOADS]: The skill provides routines to download necessary third-party tools and assets:
Downloads a portable Blender distribution from the official https://download.blender.org/ domain for 3D model processing.
Fetches font files and brand wordmarks from the author's official static asset domain https://static.higgsfield.ai/ via the compose_cover.py script.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to generate code and assets based on user-provided briefs, which presents an inherent injection surface.
Ingestion points: User intake questions and design brief metadata (app/design-brief.md).
Boundary markers: Absent. User descriptions are interpolated into model prompts without specific delimiters.
Capability inventory: The skill has access to shell tools, file system writes, and network-based generation APIs.
Sanitization: While the skill includes extensive instructions for securing the resulting applications (in references/security.md), the internal prompt construction for assets does not explicitly sanitize input.
[SAFE]: The included Python and shell scripts in the scripts/ directory are functional utilities designed for 3D conversion, rigging, and video processing required by the skill's core functionality.

higgsfield-websites