The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The README.md provides installation instructions for the official Higgsfield CLI using curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh. This download originates from the official GitHub organization of the platform for which this skill is designed, making it a trusted source for execution tooling.
[PROMPT_INJECTION]: The skills/higgsfield-recall/SKILL.md sub-skill includes instructions to run memory checks and apply fixes 'SILENTLY in the background' without announcing them to the user. While this overrides standard conversational transparency, it is a benign UX optimization designed to reduce verbosity during the prompt construction process.
[COMMAND_EXECUTION]: Several Python scripts in the scripts/ directory (e.g., validate.py, refresh_specs.py) use the subprocess module to call the official higgsfield CLI and other local repository tools for data synchronization and validation. These are standard developer maintenance tasks and do not involve arbitrary command execution of untrusted input.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses a workspace/ folder structure to manage local file ingestion. While this creates a potential surface for indirect prompt injection if malicious documents are processed, the skill does not attempt to access sensitive system paths (like .ssh or .aws) or exfiltrate data to unauthorized domains. All network operations are directed toward legitimate platform services.

higgsfield