higgsfield-websites

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

**Attack:** Server function accepts a URL from the client and fetches it. Attacker provides `http://169.254.169.254/latest/meta-data/` (cloud metadata), `http://localhost:8787/internal-api`, or intern

Also check for: internal network access (`localhost`, `127.0.0.1`, `10.*`, `192.168.*`, `169.254.169.254` -- the metadata endpoint).

**Attack:** Server function accepts a URL from the client and fetches it. Attacker provides `http://169.254.169.254/latest/meta-data/` (cloud metadata), `http://localhost:8787/internal-api`, or intern

// Authenticated server function: submit the same input with its opaque token.

**Goals:** Access other users' data, inject content, abuse server resources, exfiltrate secrets.

- CSRF: state-changing server functions (POST/PUT/DELETE) must verify origin or use CSRF tokens. TanStack Start server functions include origin checking by default -- verify it's not disabled.

headers.set('Access-Control-Allow-Credentials', 'true'); // browser ignores * with credentials, but intent is wrong

headers.set('Access-Control-Allow-Credentials', 'true');

Audit 0.4.1 · source sha dd78216397f7 · 27 Oct 2026Report an issue or request a re-scan

• Publisherhiggsfield-ai GitHub organizationOwner of the repository this skill is read from
• Source folderhiggsfield-ai/skills/higgsfield-websitesThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdictdd78216397f7A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website ...`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1/R2/KV/DO/Containers). THREE product…

---
version: 0.13.0
name: higgsfield-websites
description: |
  Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website ...`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1/R2/KV/DO/Containers). THREE product types, picked via `--type` on create: `website` (standalone, no Higgsfield integration — references/website-flow.md), `app` (Sign in with Higgsfield + fnf SDK, Quanta — references/app-flow.md), `game` (realtime multiplayer rooms — references/game-flow.md). Routes to the right flow; each carries its own rules and deploy/publish gates.
  Use when: "build me a website", "make a landing page", "create a web app", "build a SaaS dashboard / portfolio", "make me a game", "deploy this site", "publish". Also owns GAME ART: "make a spritesheet", "tileable texture", "animate a 3D character", game music/SFX — see the game-* references.
  NOT for: single image/video/audio generation (higgsfield-generate), product photos (higgsfield-product-photoshoot), marketplace cards (higgsfield-marketplace-cards).
argument-hint: "[what to build or edit] [--type website|app|game]"
allowed-tools: Bash
---

# Higgsfield website builder (CLI) — three product types, three flows

You drive the whole lifecycle through the **Higgsfield CLI** (`higgsfield
website ...`), then edit code on the local filesystem with `git` + `bun`. You are
building ONE per-website Cloudflare Worker: a **React 19 + TanStack Start** app,
**server-rendered (SSR)**, deployed as a single Worker at the product's own
subdomain. The project lives in **`app/`** — run every `bun`/build command from
there.

## The three types — and the REQUIRED `--type` on create

`higgsfield website create` requires `--type`, and it is the **USER'S choice** —
when the request doesn't make it obvious, ask the user before creating (one
question, up front):

- **`--type website`** — a standalone product with NO Higgsfield integration
  and **NO AI generation of any kind** (no image/video/audio/text generation —
  not via Higgsfield, and not via some other provider): no "Sign in with
  Higgsfield", no requests to Higgsfield, no fnf SDK. Every website gets a
  fully independent brand: own palette, type, and chrome from a design brief,
  custom Tailwind/CSS only — never import `@higgsfield/quanta/*` or use
  q-prefixed tokens anywhere, and no "Powered by / Built on Higgsfield" badges
  or mentions in page content. The user's brand is the only brand on the page.
  ```bash
  higgsfield website create --type website
  ```
- **`--type app`** — a product tightly integrated with Higgsfield: its users
  Sign in with Higgsfield and generate images/videos through the fnf SDK (the
  full auth + D1 contract applies). An app must look and feel like a Higgsfield
  product: UI built with **Quanta** (`references/quanta-design.md`) — and, for
  anything Quanta lacks, your own component built from Quanta primitives (never a
  third-party UI library) — starting from a standard app layout
  (`references/app-layouts.md`). Quanta and the app layouts are app-only — never
  applied to a `--type website` build. The independent-brand rule and the wow
  pipeline (`design-taste-frontend`, boards, wow catalog) are the website path;
  apps never get a custom brand — Quanta is the brand.
  ```bash
  higgsfield website create --type app
  ```

- **`--type game`** — a browser game: realtime multiplayer rooms on the game
  template, where the game itself is six pure functions in `app/src/logic.js`
  and the platform already owns sockets, rooms and persistence. Requires a
  **game genre** as `--category` (`arcade`, `puzzle`, `shooter`, ..., from
  `higgsfield website categories`) and takes **no** `--template` — a game
  scaffolds from the only template it can use. Single-player counts: set
  `minPlayers: 1`. See `references/game-flow.md`.
  ```bash
  higgsfield website create --type game --category arcade
  ```

**Generation is ALWAYS an app.** Any product that generates images, video,
audio, or other AI media runs on Higgsfield — build it as `--type app` (Sign
in with Higgsfield, generation on the user's Higgsfield credits). NEVER offer
the user an option to "bring your own image/video API" or plug in their own
generation key for a website — that path does not exist. `--type website` is
ONLY for sites with no generation and no tie to Higgsfield or any other
generation service. (A website may still use ordinary non-generation
third-party APIs — payments, maps, email — with the user's own keys; that is
unrelated to this rule.)

Quick tells: "landing page / portfolio / marketing site / SaaS with its own
users, no AI generation" → website. "generates images/video/audio, or anything
with Higgsfield models, credits, or generation history" → app. "something you
play — a game, multiplayer or single-player" → game.

Games moved onto this pipeline from a separate engine that is being retired.
The `higgsfield game ...` commands are gone: a game is created, deployed and
published exactly like a website. Any doc saying otherwise is out of date.

## Always set a subdomain on create

`higgsfield website create` takes an optional `--subdomain` — it becomes the
site's slug, so the live URL is `<subdomain>.<host>`. **Always set it:** pick
one from the product's name or purpose; only omit it (which yields a random
slug) if the user explicitly wants a random one. Rules for a good subdomain:

- **More than 4 characters** — short single words are reserved, so go a bit longer.
- **Memorable** — derive it from the product name/purpose (e.g. `lumen-notes`,
  `pixelforge`), not a random string.
- **Allowed characters only** — lowercase letters, digits, and single hyphens
  (DNS-safe). No spaces, underscores, uppercase, or leading/trailing hyphens.

A few reserved labels (e.g. `api`, `www`, `app`) and already-taken subdomains
are rejected — if that happens, try a close variant.

## Prerequisites

1. If `higgsfield` is not on `$PATH`, install it:
   ```bash

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-27
   !CAUTION B 89 / 100

   first audit · source dd78216397f7

Questions about higgsfield-websites

• github.com/higgsfield-ai/skills/tree/main/higgsfield-websites — the audited source at commit dd78216397f7 and every finding aboveObserved · 27 Oct 2026

Spotted something wrong? Report a correction · Methodology