pencil-design-from-stitch-html
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML data provided by users or fetched from remote URLs, creating a surface for indirect prompt injection. Ingestion points: HTML content is ingested via user-pasted text or downloaded from URLs like htmlCode.downloadUrl provided by the Stitch MCP server. Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions within the processed data. Capability inventory: Access to shell execution (Bash), file system operations (Read, Write), and specialized design tools (mcp_pencil, stitch). Sanitization: No sanitization or filtering of the HTML content is defined before parsing.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs network requests using Bash or web_fetch to download assets from stitch.withgoogle.com. This is a well-known service associated with Google, and the activity is essential for the skill's core conversion functionality.
Audit Metadata