技能 higgsfield-websites
📦

higgsfield-websites

v0.12.0 内容修订 r2 严重 🌐 网络访问📁 文件系统访问⚙️ 外部命令🔑 环境变量⚡ 包含脚本

构建 Higgsfield 网站和应用

发布精美的 Web 产品需要设置、设计、安全和部署步骤。此技能会引导 Claude、Codex 和 Claude Code 完成 Higgsfield CLI 网站和应用工作流。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "higgsfield-websites" from https://skillstore.io/skills/higgsfield-ai-higgsfield-websites.md and its manifest at https://skillstore.io/api/skills/higgsfield-ai-higgsfield-websites/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/higgsfield-ai-higgsfield-websites.md 已签名 manifest GET /api/skills/higgsfield-ai-higgsfield-websites/manifest 已签名 lockfile GET /api/skills/higgsfield-ai-higgsfield-websites/lockfile

测试它

正在使用“higgsfield-websites”。 为一家设计机构构建落地页。

预期结果:

一个可预览的 Higgsfield 网站，包含自定义品牌方向、响应式版块、SEO 元数据，以及仍存在时清晰列出的发布阻塞项。

正在使用“higgsfield-websites”。 为已登录用户创建图像生成应用。

预期结果:

一个应用计划和实现路径，包含 Higgsfield 登录、fnf SDK 使用、生成控制、历史视图和预览部署。

正在使用“higgsfield-websites”。 发布前检查这个项目。

预期结果:

一份简洁的发布审查，涵盖身份认证、存储、安全性、SEO、封面图质量、部署状态和剩余生产步骤。

安全审计

严重
v3 • 2026/7/23 打开版本化报告

Most detections are false positives caused by Markdown examples and defensive security guidance. The skill still executes an unverified remote installer, imports unpinned third-party components, and defaults to public deployment. It also attempts to override other skills and obscures deployment operations from users.

22
已扫描文件
8,130
分析行数
9
复核项
0
已忽略误报

已确认安全问题 (4)

严重
SKILL.md:98
Pipe to shell pattern
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
The prerequisite command pipes a remote install script directly into sh without pinning or integrity verification. This creates immediate supply-chain code-execution risk.
高
SKILL.md:156-158
Prompt Injection Attempt Detected
The skill states, "no other skill ... overrides these rules." This attempts to control instruction priority and suppress independent guidance.
The quoted instruction explicitly claims precedence over other skills. It is not needed to explain website-building behavior.
高
SKILL.md:152-175references/app-flow.md:131-136
Live Deployment Without Explicit Consent
The skill defaults to deploying every build as a live public site, even when the user asked only to build or edit. It also hides deployment terminology.
The files explicitly say deployment is public, has no preview stage, and is the default final step. User-facing messages are told to avoid deploy terminology.
中
SKILL.md:124-139references/asset-system.md:9-118
Unprompted External Asset Generation
The skill mandates many external image-generation jobs and rerolls without asking. Permission is required only for optional video generation.
The workflow requires reference boards, candidate assets, rerolls, and covers. It explicitly says the cover image needs no permission.
能力复核项 (9)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

严重
SKILL.md:98
Hardcoded URL
curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh
This URL supplies an installer that is fetched from a mutable GitHub branch and passed directly to a shell. A compromised upstream response would execute with the agent's local privileges.
高
references/wow-maker.md:216
Hardcoded URL
"@magicui": "https://magicui.design/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:217
Hardcoded URL
"@cult-ui": "https://www.cult-ui.com/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:218
Hardcoded URL
"@smoothui": "https://smoothui.dev/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:219
Hardcoded URL
"@ncdai": "https://chanhdai.com/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:220
Hardcoded URL
"@motion-primitives": "https://motion-primitives.com/c/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:221
Hardcoded URL
"@kokonutui": "https://kokonutui.com/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:222
Hardcoded URL
"@tailark": "https://tailark.com/r/{name}.json",
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.
高
references/wow-maker.md:223
Hardcoded URL
"@eldoraui": "https://eldoraui.site/r/{name}.json"
This URL is configured as a third-party component registry used by unpinned shadcn add commands. Registry content is copied into the project without a version pin, checksum, or required source review.

风险因素

🌐 网络访问 (50)
references/app-cover.md:120 references/app-cover.md:121 references/app-quickstart.md:41 references/app-quickstart.md:59 references/app-quickstart.md:41 references/app-quickstart.md:87 references/app-quickstart.md:106 references/auth.md:63 references/auth.md:95 references/auth.md:208 references/auth.md:291 references/auth.md:292 references/auth.md:296 references/auth.md:63 references/auth.md:208 references/auth.md:291 references/auth.md:296 references/containers.md:95 references/containers.md:160 references/containers.md:169 references/containers.md:260 references/containers.md:284 references/containers.md:285 references/containers.md:291 references/containers.md:68 references/containers.md:150 references/containers.md:201 references/containers.md:260 references/design-taste-frontend.md:1048 references/fnf-sdk.md:179 references/fnf-sdk.md:249 references/fnf-sdk.md:138 references/fnf-sdk.md:154 references/fnf-sdk.md:179 references/fnf-sdk.md:385 references/fnf-sdk.md:427 references/fnf-sdk.md:635 references/runtime-and-infra.md:140 references/security.md:311 references/security.md:321 references/security.md:388 references/security.md:391 references/security.md:421 references/security.md:429 references/security.md:532 references/security.md:759 references/security.md:769 references/security.md:401 references/security.md:600 references/security.md:753
📁 文件系统访问 (9)
references/app-flow.md:99 references/app-quickstart.md:14 references/quanta-design.md:185 references/quanta-design.md:474 references/security.md:20 references/security.md:20 references/security.md:735 references/security.md:240 references/security.md:710
⚙️ 外部命令 (50)
references/app-quickstart.md:67-69 references/app-quickstart.md:69-70 references/app-quickstart.md:222 references/auth.md:113-115 references/auth.md:131-133 references/auth.md:273-283 references/auth.md:297-299 references/containers.md:95-96 references/containers.md:96-98 references/containers.md:98-100 references/containers.md:156-201 references/containers.md:201-204 references/containers.md:204-205 references/containers.md:205-231 references/containers.md:231-232 references/containers.md:291-293 references/containers.md:293-296 references/design-taste-frontend.md:471-489 references/security.md:336-344 references/security.md:356-358 references/security.md:454-456 references/security.md:456-482 references/security.md:532-535 references/security.md:545-553 references/security.md:677-681 references/security.md:878-881 references/security.md:881-887 references/security.md:887-890 references/seo.md:168-179 references/seo.md:207-217 references/seo.md:245-248 references/seo.md:251-261 SKILL.md:6 SKILL.md:8 SKILL.md:10 SKILL.md:26-27 SKILL.md:27 SKILL.md:30 SKILL.md:33 SKILL.md:35 SKILL.md:39 SKILL.md:44 SKILL.md:47-49 SKILL.md:49-50 SKILL.md:50-53 SKILL.md:53-56 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-60 SKILL.md:60-62
🔑 环境变量 (13)
references/design-taste-frontend.md:1047 references/fnf-sdk.md:173 references/fnf-sdk.md:174 references/fnf-sdk.md:173 references/fnf-sdk.md:174 references/security.md:626 references/security.md:787 references/security.md:626 references/security.md:787 references/security.md:354 references/security.md:357 references/security.md:532 references/security.md:786
⚡ 包含脚本 (10)
references/security.md:594 references/security.md:685 references/security.md:861 references/security.md:594 references/security.md:685 references/security.md:861 references/security.md:594 references/security.md:685 references/security.md:861 references/wow-maker.md:273

检测到的模式

Pipe to shell pattern
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/higgsfield-ai-higgsfield-websites/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-websites/security.svg)](https://skillstore.io/skills/higgsfield-ai-higgsfield-websites?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/higgsfield-ai-higgsfield-websites?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-websites/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/higgsfield-ai-higgsfield-websites.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

higgsfield-ai. (2026). higgsfield-websites security audit report (audit version 3) [Author version 0.12.0]. Skillstore. https://skillstore.io/skills/higgsfield-ai-higgsfield-websites/audits/3

BibTeX 引用

@techreport{higgsfield-ai-higgsfield-ai-higgsfield-websites-2026, author = {higgsfield-ai}, title = {higgsfield-websites security audit report (audit version 3)}, institution = {Skillstore}, year = {2026}, number = {3}, url = {https://skillstore.io/skills/higgsfield-ai-higgsfield-websites/audits/3}, note = {Author version 0.12.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "higgsfield-websites security audit report (audit version 3)" version: "0.12.0" type: report authors: - name: "higgsfield-ai" date-released: "2026-07-23" url: "https://skillstore.io/skills/higgsfield-ai-higgsfield-websites/audits/3" identifiers: - type: other value: "skillstore:higgsfield-ai-higgsfield-websites:audit:3" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
45
架构
100
可维护性
87
内容
67
社区
91
规范符合性

你能构建什么

发布营销网站

创建一个独立的品牌网站，包含自定义视觉、SEO 元数据、预览部署和发布检查。

构建生成应用

创建一个 Higgsfield 集成应用，包含登录、生成工作流、Quanta UI 指导和 fnf SDK 模式。

打磨现有项目

改进现有 Higgsfield 项目的布局、安全性、身份认证、元数据、封面资源和部署就绪状态。

试试这些提示

创建基础网站 
为我的新产品构建一个预览网站。使用独立网站流程，如果有任何必需选择不明确，请询问我。
设计品牌落地页 
创建一个具有强烈视觉方向、响应式版块、SEO 元数据和预览部署的品牌落地页。
构建 AI 生成应用 
构建一个 Higgsfield 应用，让已登录用户可以生成媒体、查看结果并查看生成历史。
准备生产发布 
检查我的 Higgsfield 应用是否存在身份认证、存储、SEO、封面图和安全问题，然后部署预览并准备生产发布步骤。

最佳实践

  • 创建任何项目之前，先确认是网站还是应用。
  • 默认使用预览部署，并在生产发布前询问用户。
  • 处理用户数据之前，先审查安全性、SEO、身份认证和存储指导。

避免

  • 未经用户明确同意，通过 CLI 安装或部署。
  • 将独立网站流程用于 AI 媒体生成产品。
  • 在面向用户的消息中暴露令牌、原始 ID 或基础设施细节。

常见问题

这个技能会构建什么？
它使用 Higgsfield CLI 和基于 React 的项目结构构建 Higgsfield 网站和 Higgsfield 集成 Web 应用。
什么时候应该选择 website，什么时候选择 app？
对于独立的营销或产品网站，请选择 website。当产品使用 Higgsfield 登录、生成、积分或历史记录时，请选择 app。
它需要 shell 访问权限吗？
是的。该工作流使用 Bash、Higgsfield CLI、git、bun、本地文件和部署命令。
它可以部署到生产环境吗？
可以，但生产部署应仅在用户明确要求发布或上线后进行。
它支持 AI 生成应用吗？
支持。生成产品使用应用流程，包含 Higgsfield 登录、fnf SDK 指导和基于账户的生成积分。
远程 CLI 安装安全吗？
应先进行审核。当前技能包含远程安装命令，安全审计应将其视为高风险。

开发者详情

许可证

MIT

作者版本

v0.12.0

Skillstore 修订

r2

仓库

https://github.com/higgsfield-ai/skills/tree/main/higgsfield-websites/

引用

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

维护新鲜度

2026/7/25

使用量

2 次下载 · 0 次浏览

文件结构

📁 references/

📄 app-cover.md

📄 app-flow.md

📄 app-layouts.md

📄 app-quickstart.md

📄 asset-system.md

📄 auth.md

📄 containers.md

📄 design-recipe.md

📄 design-taste-frontend.md

📄 fnf-react.md

📄 fnf-sdk.md

📄 image-to-code.md

📄 quanta-design.md

📄 reference-boards.md

📄 review-rubric.md

📄 runtime-and-infra.md

📄 security.md

📄 seo.md

📄 website-flow.md

📄 wow-catalog.md

📄 wow-maker.md

📄 SKILL.md

higgsfield-ai 的更多技能

查看全部

相关技能

查看全部