The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/connect.py implements a command to download and execute a shell script from a remote URL (https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh) by piping the output of curl directly to sh. This pattern allows for arbitrary code execution from an external, untrusted source, which is highly susceptible to tampering or repository compromise.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party software from untrusted repositories. Specifically, it executes an installation script from the higgsfield-ai GitHub organization, which is not a verified or trusted vendor, increasing the risk of supply chain attacks.
[COMMAND_EXECUTION]: The scripts/connect.py utility uses subprocess.run with shell=True to execute installation commands. This is an unsafe practice that increases the risk of command injection, especially when the command strings are derived from external installation procedures.
[DYNAMIC_EXECUTION]: The skill's installation logic dynamically constructs and executes shell commands for provider setup (such as Higgsfield and Codex). This runtime execution of generated command strings poses a security risk if the source content is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied product descriptions and image references, which are interpolated into prompts for various image and video generation providers in scripts/creator.py. The skill lacks sufficient boundary markers or sanitization to prevent malicious instructions within user data from influencing the agent's behavior.
Ingestion points: Argument parsing for --prompt and --ref in scripts/creator.py.
Boundary markers: Absent in the prompt construction logic.
Capability inventory: The skill can execute local binaries (e.g., ffmpeg, higgsfield, codex, agy) and perform network operations targeting multiple AI service APIs.
Sanitization: No input validation or escaping mechanisms are present for user-controlled strings before interpolation.

creator-product-photo