The Agent Skills Directory

[SAFE]: The skill incorporates comprehensive security best practices. It explicitly prohibits the collection of user credentials and sensitive session data. It also correctly identifies and warns against the security risk of including private RPC keys in public-facing VITE_* environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external design assets to generate code, which constitutes a managed attack surface.
Ingestion points: The skill ingests Stitch design screens (HTML, screenshots) and project DESIGN.md files as described in references/workflow.md and SKILL.md.
Boundary markers: The workflow includes mandatory intent clarification and pre-flight verification steps (Step 1 and 2 in SKILL.md) to establish safe execution boundaries.
Capability inventory: The skill is designed to write React component files and execute standard development CLI tools for linting, typing, and building applications.
Sanitization: Instructions explicitly require the agent to replace real customer data (names, phone numbers, order IDs) with demo values and to audit metadata for hardcoded secrets before any output is finalized, as documented in SKILL.md and references/faq-deep.md.

stitch-react-vite-dashboard