The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the installation of the Higgsfield CLI by executing a remote script directly in the shell using the command 'curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh'.
[COMMAND_EXECUTION]: The bundled Python scripts (brandkit.py, build_brandbook.py, and render_brandbook_pdf.py) utilize subprocess.run() to invoke several local command-line utilities, including magick, convert, rsvg-convert, soffice, pdftoppm, and pdffonts. These tools provide an interface to the local system for image manipulation and document processing.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted user-supplied brand briefs and files (SVG, PNG, PPTX, PDF) in asset-analysis.md. These are subsequently interpolated into prompts for downstream image models like Recraft, Seedream, and GPT Image 2. The skill includes a 'no text' constraint tail in logo-prompt-enhancer.md to manage model output, and brandkit.py includes a validate_svg function that filters for active content such as and iframe tags to mitigate risks.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to download the Brandbook PPTX template from a Google Docs export URL and fetches font files from Google Fonts.
[SAFE]: The skill implements significant security best practices, including a validate_svg function that sanitizes SVG files by rejecting active content (scripts, iframes, event handlers) and an assert_public_host function that protects against Server-Side Request Forgery (SSRF) by verifying that remote hostnames resolve to global, public IP addresses before fetching data.

higgsfield-brandkit