The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a shell script from a remote URL (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) using the 'curl | sh' pattern. This method of installation executes unverified code from a remote source directly in the shell environment.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from an external GitHub repository belonging to the 'higgsfield-ai' organization. This organization is not recognized as a pre-verified trusted source, and the bootstrap process involves downloading an installer script.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of external data. * Ingestion points: The skill reads external web research results and local source documents in Phase R and the Inputs section of SKILL.md. * Boundary markers: The instructions state that documents are "factual input, not generation media," but this is a weak boundary that does not technically isolate or sanitize the untrusted content. * Capability inventory: The agent has access to the 'Bash' tool, enabling it to execute CLI commands and interact with the file system based on potentially malicious instructions. * Sanitization: No sanitization, escaping, or validation of the ingested external content is performed before it is used to generate narration and video prompts.
[COMMAND_EXECUTION]: The skill utilizes the 'Bash' tool to perform complex command-line operations with the Higgsfield CLI, including listing presets, creating generation jobs, and resolving model contracts. This grants the skill broad control over the video generation workflow and associated remote service calls.

higgsfield-video-explainer