stitch-react-components

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform standard development tasks using the Bash tool, including running npm install for project dependencies, npm run dev for visual confirmation, and npm run validate for architectural checks.
  • [EXTERNAL_DOWNLOADS]: The skill uses a bash script scripts/fetch-stitch.sh to download design assets from Google Cloud Storage URLs provided by the Stitch MCP tool. The script uses curl -L to handle redirects and TLS reliably for these design resources.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The agent reads and parses HTML content downloaded from external Stitch design URLs to extract layout and style information for component generation.
  • Boundary markers: None explicitly present; the agent is instructed to treat the downloaded HTML as a source for component extraction.
  • Capability inventory: The skill has Write access to create component files and Bash access to execute development scripts and the fetch utility.
  • Sanitization: No specific sanitization or filtering is applied to the downloaded design HTML before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 01:51 AM