The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md and skills/higgsfield-stack/SKILL.md files provide instructions to install the Higgsfield CLI using a curl-to-shell pipe pattern: curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. This pattern is highly risky as it executes remote code without verification.
[PROMPT_INJECTION]: The skill contains instructions that mandate the AI to perform actions silently without informing the user. Specifically, skills/higgsfield-recall/SKILL.md states: 'This skill should run SILENTLY in the background — don't announce it, just apply what's known.' This attempt at behavior concealment is a form of prompt injection that reduces user oversight.
[COMMAND_EXECUTION]: The skill includes several Python scripts (scripts/validate.py, scripts/refresh_specs.py, etc.) that utilize subprocess.run() and subprocess.check_output() to execute shell commands. While used for repo maintenance, these represent a high-risk capability if combined with unvalidated inputs.
[INDIRECT_PROMPT_INJECTION]: The skill implements a learning memory system that queries JSON databases (db/filter-memory.json and db/quality-memory.json) and applies 'fixes' to prompts automatically. This creates a vulnerability surface where malicious content injected into the databases could influence agent behavior.
Ingestion points: Data from local JSON databases is read by scripts/higgsfield_memory.py and injected into the agent context via the recall skill.
Boundary markers: Absent. The skill does not use clear delimiters to distinguish between retrieved memory and current instructions.
Capability inventory: The skill possesses shell execution capabilities through the Python subprocess module and broad permissions in .claude/settings.json.
Sanitization: The skill uses basic regex-based linting in scripts/seedance_lint.py, but lacks robust sanitization to prevent the AI from following instructions embedded in retrieved data.

higgsfield