# Build Full-Stack Websites with Higgsfield

Building a production website requires design, infrastructure, security, and deployment decisions. This skill guides Claude or Codex through a structured Higgsfield CLI workflow.

## Install

```bash
npx skillstore add higgsfield-ai/higgsfield-websites
```

## Metadata

- Status: approved
- Slug: higgsfield-ai-higgsfield-websites
- Version: 0.12.0
- Author version: 0.12.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: 222b62730580b26547c19c84b0d22bd84bc608a0aae264123a3a39c2a427bc14
- Author: higgsfield-ai
- GitHub username: higgsfield-ai
- License: MIT
- Repository: https://github.com/higgsfield-ai/skills/tree/main/higgsfield-websites/
- Ref: c43861a65bb95efcae259cd161c9d6f4dc7eec6f
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands, env\_access, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/higgsfield-ai-higgsfield-websites
- Manifest: https://skillstore.pages.dev/api/skills/higgsfield-ai-higgsfield-websites/manifest

## Capabilities

- Creates standalone websites or Higgsfield-integrated apps using a required product type.
- Guides React 19 and TanStack Start SSR implementation for one Cloudflare Worker.
- Covers D1, R2, KV, Durable Objects, containers, authentication, and server functions.
- Generates design briefs, reference boards, site assets, launch covers, and metadata.
- Runs type checks and template quality gates before deployment.
- Supports public subdomain deployment and optional community-feed publishing.

## Use Cases

- Launch a Marketing Website: Create a branded landing site with generated assets, responsive pages, metadata, and Cloudflare deployment.
- Build a Higgsfield Generation App: Create an authenticated Quanta interface for media generation, job tracking, credits, history, and result delivery.
- Maintain a Deployed Product: Update routes, components, storage, integrations, or copy while preserving required checks and publication metadata.

## Prompt Templates

### Create a Basic Website

```
Build a standalone website for [business]. Use [brand details], create essential pages, and request approval before public deployment.
```

### Create an Integrated App

```
Create a Higgsfield app for [workflow]. Include authentication, generation controls, result history, loading states, errors, and a Quanta interface.
```

### Edit an Existing Product

```
Edit my existing [website or app]. Change [features], preserve current behavior, run required checks, and explain deployment impact before publishing.
```

### Build a Secure Full-Stack Product

```
Build [product] with D1, R2, and [integration]. Define threats, validate authorization, test failure states, and confirm every external release.
```

## Limitations

- Requires the Higgsfield CLI, an authenticated account, Git, Bun, and access to the generated project.
- Deployment creates a live public site because no preview environment exists.
- Standalone websites cannot use Higgsfield generation, sign-in, Quanta, or the fnf SDK at runtime.
- App projects must use Quanta and Higgsfield authentication, limiting independent branding and UI libraries.

## Best Practices

- Confirm product type, branding, integrations, and public-release intent before creating or deploying.
- Keep secrets in platform bindings and review every third-party dependency or generated component.
- Run type checks, quality gates, authorization reviews, and accessibility checks before release.

## Anti Patterns

- Do not pipe remote installers into a shell or use unpinned component registries.
- Do not deploy a live public site when the user requested only a local build or edit.
- Do not expose secrets, bypass server-side authorization, or send raw files through JSON.

## Security Audit

- Audited at: 2026-07-23T18:27:06.814\+00:00
- Summary: Most detections are false positives caused by Markdown examples and defensive security guidance. The skill still executes an unverified remote installer, imports unpinned third-party components, and defaults to public deployment. It also attempts to override other skills and obscures deployment operations from users.

## Stats

- Views: 0
- Downloads: 5
- Favorites: 0
- Popularity score: 0