The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to search for and store a Pixazo API key in ~/.pixazo/api-key. While this involves a sensitive file path, it is a standard implementation for persistent credential management in CLI-integrated tools.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to fetch supplementary model documentation and parameter schemas from the vendor's website at https://www.pixazo.ai/models/higgsfield.md. This is a legitimate request for vendor-provided technical specifications.
[COMMAND_EXECUTION]: The documentation provides curl command examples and suggests using npx for installing related skills. These are provided as implementation references for the agent and user.
[INDIRECT_PROMPT_INJECTION]: The skill features a vulnerability surface where it retrieves external technical content from the vendor's domain which is then processed by the agent.
Ingestion points: External markdown documentation at https://www.pixazo.ai/models/higgsfield.md.
Boundary markers: Absent; the agent is instructed to load the URL to resolve parameter names and schemas.
Capability inventory: Network operations via HTTP requests, local file writing, and shell command execution.
Sanitization: Absent; the agent consumes the remote content as a functional reference.

higgsfield