Skills/skills.sh/higgsfield-brandkit

higgsfield-brandkit@0.14.0

CAUTION

Publisher claims: "Create and extend complete visual brand systems through the Higgsfield CLI and bundled deterministic local tooling: palettes, SVG logo marks, typography, mockups, social graphics, packaging, signage, merchandise, posters, presentation decks, and editable PPTX/PDF brandbooks. Preserves official supplied assets, persists approvals locally, and regenerates only dependent outputs. Use when: "create a brand kit", "make a visual identity", "design a logo and brandbook", "apply this logo to branded assets", "make packaging or signage", or "extend our existing branding". Chain with higgsfield-generate for general image production and Marketing Studio brand-kits when importing website metadata for ads. NOT for unbranded image generation (use higgsfield-generate), product catalog photography (use higgsfield-product-photoshoot), website implementation (use higgsfield-websites), or native Figma/Canva/PSD/AI delivery. " Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher higgsfield-ai · joined 12 days agoInstalls 111KLast detonated 6d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Direct script execution from GitHub raw URL; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Remote installer piped to shellSKILL.md:28 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedscripts/build_brandbook.py:547 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/render_brandbook_pdf.py:30 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/brandkit.py:1051 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/brandkit.py:1031 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Direct script execution from GitHub raw URLSKILL.md:28 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Pipe-to-shell patternSKILL.md:28 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Python subprocess execution detectedscripts/build_brandbook.py:920 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_brandbook.py:508 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim higgsfield-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  5. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to skills.sh, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim higgsfield-ai