The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses a highly risky command in SKILL.md to install the Higgsfield CLI: curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. This executes a remote script from an unverified GitHub repository directly in the system shell without integrity verification, creating a direct path for arbitrary code execution as flagged by automated scanners.\n- [EXTERNAL_DOWNLOADS]: The skill initiates multiple downloads from external sources, including portable Blender software from blender.org, system libraries from Debian repositories, and 3D assets from third-party GitHub accounts. While some sources are well-known, the broad intake of external dependencies increases the supply chain risk profile.\n- [COMMAND_EXECUTION]: The skill extensively utilizes the Bash tool to execute local Python scripts, manage file system operations like archiving and extracting files, and interact with the external higgsfield CLI. This requires significant privileges to operate correctly within the environment.\n- [PROMPT_INJECTION]: The skill ingests untrusted user data from game briefs and asset requests (ingestion points) and interpolates them into generative AI prompts without explicit boundary markers or sanitization. Given the skill's capabilities (inventory: shell execution, file writes, network calls), this represents a surface for indirect prompt injection where malicious input could influence downstream agent actions.

higgsfield-game-generation