Skills
skills/full-stack-skills/stitch-skills/stitch-react-components/Gen Agent Trust Hub

stitch-react-components

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a local bash script (scripts/fetch-stitch.sh) to download HTML content using curl. This is a utility for reliable asset retrieval from the design service.
  • [EXTERNAL_DOWNLOADS]: Fetches design metadata and HTML files from Stitch (Google infrastructure) URLs provided by the MCP tools. These downloads are essential for the conversion process.
  • [PROMPT_INJECTION]: The skill ingests and parses external HTML data, which represents a surface for indirect prompt injection. This is an inherent risk of design-to-code automation and is mitigated by the skill's context within a controlled developer environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:08 PM
Security Audit — agent-trust-hub — stitch-react-components