The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions to install the Higgsfield CLI by fetching a shell script from https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh and piping it directly into the shell (| sh). This pattern provides a direct path for arbitrary code execution from a remote source.
[EXTERNAL_DOWNLOADS]: The skill downloads code from an external source (raw.githubusercontent.com/higgsfield-ai/cli/...) which is not under the user's control or on the provided list of trusted vendors.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute higgsfield CLI commands such as higgsfield generate create and higgsfield model get. These commands are executed with parameters derived from user input.
[PROMPT_INJECTION]: The skill ingests untrusted user data and interpolates it into prompts for high-capability generative AI models.
Ingestion points: The video-topic-or-title argument and specific scene requirements provided by the user in SKILL.md.
Boundary markers: The skill employs a structured 'Prompt contract' consisting of 11 distinct sections to define prompt structure and constraints.
Capability inventory: The skill has the capability to perform shell operations via the Bash tool and the higgsfield CLI.
Sanitization: To mitigate command injection, the skill instructions require writing the final prompt to a temporary file (thumbnail-prompt.txt) and piping that file to the CLI's standard input.

higgsfield-youtube-thumbnail