The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions to install a CLI tool by piping a script from a remote URL directly into a shell interpreter. This pattern allows for the execution of unverified and potentially malicious code on the host system. Evidence: curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill downloads executable content from a third-party GitHub repository (higgsfield-ai/cli) which is not identified as a trusted or well-known service.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute system commands, including the installation of software and the operation of the higgsfield CLI toolset.
[PROMPT_INJECTION]: The skill ingests untrusted user data such as topics and source files to generate video scripts. It lacks explicit boundary markers or sanitization to prevent these inputs from influencing the agent's behavior through indirect prompt injection.
Ingestion points: User-provided topic strings and local source documents described in SKILL.md.
Boundary markers: Absent.
Capability inventory: Execution of arbitrary shell commands via the installation script and the higgsfield CLI.
Sanitization: None identified.

higgsfield-video-explainer