技能 higgsfield-brandkit

📦

higgsfield-brandkit

Name: higgsfield-brandkit
Author: higgsfield-ai

v0.12.0 內容修訂 r1 嚴重 🌐 網路存取⚙️ 外部命令📁 檔案系統存取🔑 環境變數

Create Complete Visual Brand Systems

Brand creation often produces inconsistent assets and unclear approvals. This skill coordinates identity design, review stages, deterministic exports, and editable brandbooks.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "higgsfield-brandkit" from https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit.md and its manifest at https://skillstore.io/api/skills/higgsfield-ai-higgsfield-brandkit/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/higgsfield-ai-higgsfield-brandkit.md 已簽名 manifest GET /api/skills/higgsfield-ai-higgsfield-brandkit/manifest 已簽名 lockfile GET /api/skills/higgsfield-ai-higgsfield-brandkit/lockfile

測試它

正在使用「higgsfield-brandkit」。 Create a visual identity for Northline, a modern logistics platform serving regional manufacturers.

預期結果:

Three palette review options with editable HTML and PNG previews.
Three distinct SVG symbol candidates for explicit selection.
Approved typography pairings and a concise Brand Lock summary.

正在使用「higgsfield-brandkit」。 Apply our approved logo and colors to retail packaging and storefront signage.

預期結果:

Packaging and signage previews using the supplied official assets.
Stable variant names for focused revisions.
Editable and flattened format labels with production limitations.

正在使用「higgsfield-brandkit」。 Build final brand guidelines from our approved logo, palette, typography, and mockups.

預期結果:

An editable PPTX brandbook, a verified matching PDF, and a concise font installation warning when required.

安全審計

嚴重

v1 • 2026/8/10 開啟版本化報告

Most alerts are false positives caused by Markdown formatting, OOXML paths, file signatures, and guarded subprocess use. Confirmed risks include pipe-to-shell installation, privileged package commands, remote downloads, mutable template processing, and unbounded PPTX decompression. Publication should wait until the critical installation guidance is replaced.

已掃描檔案

5,431

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

嚴重

references/prerequisites.md:65

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The command pipes a mutable remote script directly into sh without pinning or checksum verification. Upstream compromise would provide immediate arbitrary code execution.

嚴重

SKILL.md:28

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The bootstrap command executes a mutable remote script through sh without inspection, pinning, or checksum verification. This is a direct supply-chain code execution risk.

能力複核項目 (13)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

references/prerequisites.md:47

sudo privilege escalation

sudo apt-get update

This instruction runs apt metadata updates with root privileges. User permission reduces misuse risk, but the command still changes system-wide state.

高

references/prerequisites.md:48

sudo privilege escalation

sudo apt-get install -y imagemagick librsvg2-bin poppler-utils fontconfig libreoffice

This instruction installs multiple system packages as root. It is legitimate setup, but it expands the host attack surface and requires explicit user control.

高

references/prerequisites.md:65

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The URL supplies a remote installer directly to a shell. A changed or compromised upstream script would execute with the user's privileges.

高

scripts/build_brandbook.py:30

Hardcoded URL

"https://docs.google.com/presentation/d/"

The builder downloads a mutable remote PPTX and later processes it with LibreOffice. No pinned digest verifies that the template is the audited artifact.

高

SKILL.md:28

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

The hardcoded URL is used as a remote installer source and piped into a shell. Its content is neither pinned nor verified before execution.

中

scripts/build_brandbook.py:92

Python archive libraries

with zipfile.ZipFile(BytesIO(data)) as source:

The downloaded PPTX is expanded fully into memory without limits on entry count or uncompressed size. A compressed archive bomb could exhaust memory.

低

references/brandbook.md:29

Hardcoded URL

https://docs.google.com/presentation/d/1rAfUJ-PbZ4S-h3puYSUHpE5UIcdKyRw1/export/pptx

The workflow depends on a mutable Google-hosted PPTX template. Remote availability and content integrity affect local document generation.

低

scripts/brandkit.py:56

HTTP client library

def redirect_request(self, req, fp, code, msg, headers, newurl):

This redirect handler supports actual remote SVG retrieval. HTTPS, public-address checks, redirect limits, content limits, and SVG validation substantially reduce the network risk.

低

scripts/brandkit.py:29

Python HTTP libraries

from urllib.request import HTTPRedirectHandler, HTTPSHandler, Request, build_opener

These HTTP classes are used to download approved SVG assets. The implementation restricts requests to HTTPS public hosts and validates downloaded content.

低

scripts/brandkit.py:1207

Hardcoded URL

'@import url("https://fonts.googleapis.com/css2?family='

Generated review HTML imports selected Google Fonts from an external host. This creates an intentional network request and external availability dependency.

低

scripts/build_brandbook.py:54

HTTP client library

def redirect_request(self, req, fp, code, msg, headers, newurl):

This handler supports real downloads of the template, assets, and fonts. Public-host validation, TLS, redirect limits, and byte limits constrain the exposure.

低

scripts/build_brandbook.py:23

Python HTTP libraries

from urllib.request import HTTPRedirectHandler, HTTPSHandler, Request, build_opener

The imported HTTP client is used for template, asset, and font downloads. Requests are intentional and guarded, but still cross the local network boundary.

低

scripts/build_brandbook.py:584

Hardcoded URL

"https://fonts.googleapis.com/css2?family="

The builder intentionally retrieves CSS and font files from Google Fonts. HTTPS and size limits help, but remote content is still consumed locally.

風險因素

🌐 網路存取 (16)

references/brandbook.md:29 references/logo-export-payloads.md:8 references/prerequisites.md:65 references/state-payloads.md:30 references/state-payloads.md:98 references/state-payloads.md:99 scripts/brandkit.py:56 scripts/brandkit.py:29 scripts/brandkit.py:1207 scripts/build_brandbook.py:54 scripts/build_brandbook.py:23 scripts/build_brandbook.py:30 scripts/build_brandbook.py:318 scripts/build_brandbook.py:445 scripts/build_brandbook.py:584 SKILL.md:28

⚙️ 外部命令 (43)

📁 檔案系統存取 (15)

references/prerequisites.md:24 scripts/brandkit.py:24 scripts/brandkit.py:144 scripts/brandkit.py:1029 scripts/build_brandbook.py:627 scripts/build_brandbook.py:646 scripts/build_brandbook.py:836 scripts/build_brandbook.py:20 scripts/build_brandbook.py:495 scripts/build_brandbook.py:907 scripts/build_brandbook.py:235 scripts/build_brandbook.py:24 scripts/build_brandbook.py:92 scripts/build_brandbook.py:94 scripts/build_brandbook.py:100

🔑 環境變數 (1)

scripts/render_brandbook_pdf.py:89

偵測到的模式

Pipe to shell pattern×2

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-brandkit/security.svg)](https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/higgsfield-ai-higgsfield-brandkit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/higgsfield-ai-higgsfield-brandkit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

higgsfield-ai. (2026). higgsfield-brandkit security audit report (audit version 1) [Author version 0.12.0]. Skillstore. https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1

BibTeX 引用

@techreport{higgsfield-ai-higgsfield-ai-higgsfield-brandkit-2026,
  author = {higgsfield-ai},
  title = {higgsfield-brandkit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1},
  note = {Author version 0.12.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "higgsfield-brandkit security audit report (audit version 1)"
version: "0.12.0"
type: report
authors:
  - name: "higgsfield-ai"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/higgsfield-ai-higgsfield-brandkit/audits/1"
identifiers:
  - type: other
    value: "skillstore:higgsfield-ai-higgsfield-brandkit:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 低

架構

100

可維護性

內容

社群

100

規範符合度

你可以打造什麼

Launch a new identity

Develop a palette, logo direction, typography system, and brand guidelines through staged approvals.

Extend an existing brand

Apply approved assets to packaging, signage, merchandise, social graphics, and presentations without redesigning the core identity.

Standardize campaign production

Create consistent campaign assets and editable brand documentation from a shared Brand Lock.

試試這些提示

Create a basic brand kit

Create a brand kit for [brand name]. The audience is [audience], and the desired character is [traits].

Apply an existing identity

Use the supplied official logo, colors, and fonts. Create [deliverables] while preserving every approved brand element.

Complete a partial identity

Review these existing brand assets. Identify only the missing elements required for [deliverable], then create those elements through approval stages.

Build a full brandbook

Create an editable PPTX and matching PDF brandbook for [brand]. Include approved identity foundations, usage rules, and [mockup types].

最佳實務

Provide official assets, exact brand spelling, required copy, and requested formats at the start.
Approve palette, logo, and typography choices explicitly before requesting dependent outputs.
Keep the generated state file with the project so revisions preserve prior approvals.

避免

Do not request a redesigned logo when supplied official artwork must remain unchanged.
Do not provide unverified claims, prices, certifications, ingredients, or regulatory text.
Do not expect native Figma, Canva, PSD, AI, or EPS deliverables.