The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts and system commands to perform its core functions.
It executes scripts/fetch-stitch.sh using Bash to download design assets.
It runs npm install to set up validation dependencies.
It executes node scripts/validate.js to perform AST-based code quality checks.
It instructs the agent to ask for user permission before starting local development servers with npm run dev or performing automated browser audits.
[EXTERNAL_DOWNLOADS]: The skill downloads design components and screenshots from Google Cloud Storage URLs provided by the Stitch platform.
It uses curl via the fetch-stitch.sh script to retrieve HTML and PNG files from remote signed URLs.
The skill documentation identifies this as a workaround for TLS/SNI issues when accessing Google's content delivery networks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external HTML files which represent an attack surface for indirect prompt injection.
Ingestion points: The agent reads the content of downloaded HTML files in SKILL.md Phase 2 to extract Tailwind configuration tokens.
Boundary markers: The instructions do not define specific delimiters or "ignore instructions" warnings for the content read from these external files.
Capability inventory: The skill has access to Bash, Write, and Read tools, and can execute local scripts and Node.js commands.
Sanitization: There is no explicit sanitization or validation logic described for the data extracted from the HTML <head> before it is used to overwrite resources/style-guide.json.

stitch-react-components