The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/connect.py script facilitates the installation of the Higgsfield CLI by downloading a shell script from a remote URL (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) and piping it directly to the shell (sh). This 'curl | sh' pattern is a high-risk execution method that lacks integrity verification and allows for arbitrary code execution from a non-trusted source.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process user-provided content such as articles, notes, or documents to generate video scripts, which introduces a significant attack surface for indirect prompt injection.
Ingestion points: SKILL.md instructs the agent to ingest a 'topic, article, notes, or document' to infer the audience and draft a script.
Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions within the processed data.
Capability inventory: The agent has Bash Read Write permissions and can execute various scripts (creator.py, media.py, connect.py) that perform file operations, network requests, and shell command execution.
Sanitization: The skill does not provide any mechanisms for sanitizing, escaping, or validating the external content before it is interpolated into prompts for the underlying LLM to process.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution via subprocess.run across several scripts. Specifically, scripts/connect.py uses shell=True to execute third-party installation strings, while scripts/media.py and scripts/creator.py dynamically build and execute commands for ffmpeg, ffprobe, and various provider CLIs (e.g., higgsfield, agy, codex).
[CREDENTIALS_UNSAFE]: The skill manages several high-value API keys for services like Google Gemini, OpenAI, and ElevenLabs. While scripts/connect.py implements reasonable storage practices (saving to a .env file with chmod 600 permissions), the orchestration of these secrets in an environment where the agent can execute arbitrary shell commands and make network calls increases the risk of credential exposure or exfiltration.

creator-explainer