higgsfield-brandkit@0.13.0

CAUTION

Publisher claims: "Create and extend complete visual brand systems through the Higgsfield CLI and bundled deterministic local tooling: palettes, SVG logo marks, typography, mockups, social graphics, packaging, signage, merchandise, posters, presentation decks, and editable PPTX/PDF brandbooks. Preserves official supplied assets, persists approvals locally, and regenerates only dependent outputs. Use when: "create a brand kit", "make a visual identity", "design a logo and brandbook", "apply this logo to branded assets", "make packaging or signage", or "extend our existing branding". Chain with higgsfield-generate for general image production and Marketing Studio brand-kits when importing website metadata for ads. NOT for unbranded image generation (use higgsfield-generate), product catalog photography (use higgsfield-product-photoshoot), website implementation (use higgsfield-websites), or native Figma/Canva/PSD/AI delivery. " Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher higgsfield-ai · joined 2 days agoInstalls 98,740Last detonated 37 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Pipe-to-shell patternSKILL.md:28 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

HIGH

Direct script execution from GitHub raw URLSKILL.md:28 · Direct script execution from GitHub raw URL — unverified code source

AST06

CRITICAL

Privileged sudo commandreferences/prerequisites.md:47 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

npx invocation of non-well-known packagereferences/prerequisites.md:37 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Pipe-to-shell patternreferences/prerequisites.md:65 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

HIGH

npx invocation of non-well-known packagereferences/prerequisites.md:23 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Privileged sudo commandreferences/prerequisites.md:48 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

Direct script execution from GitHub raw URLreferences/prerequisites.md:65 · Direct script execution from GitHub raw URL — unverified code source

AST06

HIGH

Python subprocess execution detectedscripts/brandkit.py:1031 · Python subprocess execution detected

AST05

HIGH

npx invocation of non-well-known packagereferences/prerequisites.md:49 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/inline-widgets.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Python subprocess execution detectedscripts/build_brandbook.py:547 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedscripts/render_brandbook_pdf.py:30 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedscripts/build_brandbook.py:508 · Python subprocess execution detected

AST05

MEDIUM

Remote installer piped to shellreferences/prerequisites.md:65 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellSKILL.md:28 · Remote installer piped to shell

AST07

HIGH

Python subprocess execution detectedscripts/build_brandbook.py:920 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedscripts/brandkit.py:1051 · Python subprocess execution detected

AST05