Habilidades higgsfield-brandkit

📦

higgsfield-brandkit

Name: higgsfield-brandkit
Author: higgsfield-ai

v0.12.0 Revisión del contenido r1 Crítico 🌐 Acceso a red⚙️ Comandos externos📁 Acceso al sistema de archivos🔑 Variables de entorno

Create Complete Visual Brand Systems

Brand creation often produces inconsistent assets and unclear approvals. This skill coordinates identity design, review stages, deterministic exports, and editable brandbooks.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

No instales este Skill automáticamente.

La política canónica exige la revisión de un operador antes de cualquier acción de instalación.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "higgsfield-brandkit" from https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit.md and its manifest at https://skillstore.io/api/skills/higgsfield-ai-higgsfield-brandkit/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/higgsfield-ai-higgsfield-brandkit.md Manifest firmado GET /api/skills/higgsfield-ai-higgsfield-brandkit/manifest Lockfile firmado GET /api/skills/higgsfield-ai-higgsfield-brandkit/lockfile

Pruébalo

Usando "higgsfield-brandkit". Create a visual identity for Northline, a modern logistics platform serving regional manufacturers.

Resultado esperado:

Three palette review options with editable HTML and PNG previews.
Three distinct SVG symbol candidates for explicit selection.
Approved typography pairings and a concise Brand Lock summary.

Usando "higgsfield-brandkit". Apply our approved logo and colors to retail packaging and storefront signage.

Resultado esperado:

Packaging and signage previews using the supplied official assets.
Stable variant names for focused revisions.
Editable and flattened format labels with production limitations.

Usando "higgsfield-brandkit". Build final brand guidelines from our approved logo, palette, typography, and mockups.

Resultado esperado:

An editable PPTX brandbook, a verified matching PDF, and a concise font installation warning when required.

Auditoría de seguridad

Crítico

v1 • 10/8/2026 Abrir el informe versionado

Most alerts are false positives caused by Markdown formatting, OOXML paths, file signatures, and guarded subprocess use. Confirmed risks include pipe-to-shell installation, privileged package commands, remote downloads, mutable template processing, and unbounded PPTX decompression. Publication should wait until the critical installation guidance is replaced.

Archivos escaneados

5,431

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Crítico

references/prerequisites.md:65

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The command pipes a mutable remote script directly into sh without pinning or checksum verification. Upstream compromise would provide immediate arbitrary code execution.

Crítico

SKILL.md:28

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The bootstrap command executes a mutable remote script through sh without inspection, pinning, or checksum verification. This is a direct supply-chain code execution risk.

Elementos de revisión de capacidades (13)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

references/prerequisites.md:47

sudo privilege escalation

sudo apt-get update

This instruction runs apt metadata updates with root privileges. User permission reduces misuse risk, but the command still changes system-wide state.

Alto

references/prerequisites.md:48

sudo privilege escalation

sudo apt-get install -y imagemagick librsvg2-bin poppler-utils fontconfig libreoffice

This instruction installs multiple system packages as root. It is legitimate setup, but it expands the host attack surface and requires explicit user control.

Alto

references/prerequisites.md:65

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The URL supplies a remote installer directly to a shell. A changed or compromised upstream script would execute with the user's privileges.

Alto

scripts/build_brandbook.py:30

Hardcoded URL

"https://docs.google.com/presentation/d/"

The builder downloads a mutable remote PPTX and later processes it with LibreOffice. No pinned digest verifies that the template is the audited artifact.

Alto

SKILL.md:28

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The hardcoded URL is used as a remote installer source and piped into a shell. Its content is neither pinned nor verified before execution.

Medio

scripts/build_brandbook.py:92

Python archive libraries

with zipfile.ZipFile(BytesIO(data)) as source:

The downloaded PPTX is expanded fully into memory without limits on entry count or uncompressed size. A compressed archive bomb could exhaust memory.

Bajo

references/brandbook.md:29

Hardcoded URL

https://docs.google.com/presentation/d/1rAfUJ-PbZ4S-h3puYSUHpE5UIcdKyRw1/export/pptx

The workflow depends on a mutable Google-hosted PPTX template. Remote availability and content integrity affect local document generation.

Bajo

scripts/brandkit.py:56

HTTP client library

def redirect_request(self, req, fp, code, msg, headers, newurl):

This redirect handler supports actual remote SVG retrieval. HTTPS, public-address checks, redirect limits, content limits, and SVG validation substantially reduce the network risk.

Bajo

scripts/brandkit.py:29

Python HTTP libraries

from urllib.request import HTTPRedirectHandler, HTTPSHandler, Request, build_opener

These HTTP classes are used to download approved SVG assets. The implementation restricts requests to HTTPS public hosts and validates downloaded content.

Bajo

scripts/brandkit.py:1207

Hardcoded URL

'@import url("https://fonts.googleapis.com/css2?family='

Generated review HTML imports selected Google Fonts from an external host. This creates an intentional network request and external availability dependency.

Bajo

scripts/build_brandbook.py:54

HTTP client library

def redirect_request(self, req, fp, code, msg, headers, newurl):

This handler supports real downloads of the template, assets, and fonts. Public-host validation, TLS, redirect limits, and byte limits constrain the exposure.

Bajo

scripts/build_brandbook.py:23

Python HTTP libraries

from urllib.request import HTTPRedirectHandler, HTTPSHandler, Request, build_opener

The imported HTTP client is used for template, asset, and font downloads. Requests are intentional and guarded, but still cross the local network boundary.

Bajo

scripts/build_brandbook.py:584

Hardcoded URL

"https://fonts.googleapis.com/css2?family="

The builder intentionally retrieves CSS and font files from Google Fonts. HTTPS and size limits help, but remote content is still consumed locally.

Factores de riesgo

🌐 Acceso a red (16)

references/brandbook.md:29 references/logo-export-payloads.md:8 references/prerequisites.md:65 references/state-payloads.md:30 references/state-payloads.md:98 references/state-payloads.md:99 scripts/brandkit.py:56 scripts/brandkit.py:29 scripts/brandkit.py:1207 scripts/build_brandbook.py:54 scripts/build_brandbook.py:23 scripts/build_brandbook.py:30 scripts/build_brandbook.py:318 scripts/build_brandbook.py:445 scripts/build_brandbook.py:584 SKILL.md:28

⚙️ Comandos externos (43)

📁 Acceso al sistema de archivos (15)

references/prerequisites.md:24 scripts/brandkit.py:24 scripts/brandkit.py:144 scripts/brandkit.py:1029 scripts/build_brandbook.py:627 scripts/build_brandbook.py:646 scripts/build_brandbook.py:836 scripts/build_brandbook.py:20 scripts/build_brandbook.py:495 scripts/build_brandbook.py:907 scripts/build_brandbook.py:235 scripts/build_brandbook.py:24 scripts/build_brandbook.py:92 scripts/build_brandbook.py:94 scripts/build_brandbook.py:100

🔑 Variables de entorno (1)

scripts/render_brandbook_pdf.py:89

Patrones detectados

Pipe to shell pattern×2

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-brandkit/security.svg)](https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-brandkit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/higgsfield-ai-higgsfield-brandkit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

higgsfield-ai. (2026). higgsfield-brandkit security audit report (audit version 1) [Author version 0.12.0]. Skillstore. https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1

Cita BibTeX

@techreport{higgsfield-ai-higgsfield-ai-higgsfield-brandkit-2026,
  author = {higgsfield-ai},
  title = {higgsfield-brandkit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1},
  note = {Author version 0.12.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "higgsfield-brandkit security audit report (audit version 1)"
version: "0.12.0"
type: report
authors:
  - name: "higgsfield-ai"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1"
identifiers:
  - type: other
    value: "skillstore:higgsfield-ai-higgsfield-brandkit:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Bajo

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

100

Cumplimiento de la especificación

Lo que puedes crear

Launch a new identity

Develop a palette, logo direction, typography system, and brand guidelines through staged approvals.

Extend an existing brand

Apply approved assets to packaging, signage, merchandise, social graphics, and presentations without redesigning the core identity.

Standardize campaign production

Create consistent campaign assets and editable brand documentation from a shared Brand Lock.

Prueba estos prompts

Create a basic brand kit

Create a brand kit for [brand name]. The audience is [audience], and the desired character is [traits].

Apply an existing identity

Use the supplied official logo, colors, and fonts. Create [deliverables] while preserving every approved brand element.

Complete a partial identity

Review these existing brand assets. Identify only the missing elements required for [deliverable], then create those elements through approval stages.

Build a full brandbook

Create an editable PPTX and matching PDF brandbook for [brand]. Include approved identity foundations, usage rules, and [mockup types].

Mejores prácticas

Provide official assets, exact brand spelling, required copy, and requested formats at the start.
Approve palette, logo, and typography choices explicitly before requesting dependent outputs.
Keep the generated state file with the project so revisions preserve prior approvals.

Evitar

Do not request a redesigned logo when supplied official artwork must remain unchanged.
Do not provide unverified claims, prices, certifications, ingredients, or regulatory text.
Do not expect native Figma, Canva, PSD, AI, or EPS deliverables.