The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/connect.py contains a command to install the Higgsfield CLI by downloading a shell script from a remote GitHub repository and piping it directly into the shell (sh). This pattern executes remote code without prior verification or integrity checks.
Evidence: "install": "curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh" in scripts/connect.py.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads and global package installations from public registries.
scripts/connect.py executes a global installation of the @openai/codex package using npm install -g.
scripts/connect.py initiates remote script downloads via curl for CLI tools.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute system commands, including patterns that use shell=True, which increases the risk of command injection if arguments are not strictly controlled.
scripts/connect.py uses subprocess.run(spec["install"], shell=True) to execute installation strings.
scripts/creator.py and scripts/media.py invoke various external binaries including higgsfield, agy, codex, gcloud, ffmpeg, and ffprobe to process media and manage tool states.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts for media generation and passes them to external AI APIs and local CLI tools. It lacks visible sanitization or boundary markers for these inputs, creating a surface for indirect prompt injection.
Ingestion points: The --prompt and --text arguments in scripts/creator.py and input files processed by media.py.
Capability inventory: The skill has permissions to write files, execute subprocesses, and perform network operations.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when interpolating user text into API payloads or tool commands.
Sanitization: There is no evidence of input validation, escaping, or filtering for prompt content before it is sent to external services or processed by local utilities.

creator-setup